If you have set the SEC_CASE_SENSITIVE_LOGON parameter to true, then the database expects "case sensitive" passwords. TOAD somehow seems to convert the passwords to uppercase before logon.

Workarounds:

1) Set your password in the database to UPPER case -- or --
2) Set SEC_CASE_SENSITIVE_LOGON parameter to false.