ORA-28001 means the user's password has expired and must be changed before the account can be used. Passwords expire when the profile's PASSWORD_LIFE_TIME and grace period have passed, or when an administrator runs ALTER USER ... PASSWORD EXPIRE, for example to force a new user to choose a password. Oracle AI Database 26ai words the message as "The account has expired. The password must be changed."
Reproduce the Error
A test user whose password is expired:
Example:
drop user if exists demo_app cascade; create user demo_app identified by "Demo_Pass_26"; grant create session to demo_app; -- expire the password, as PASSWORD_LIFE_TIME does when it runs out alter user demo_app password expire; select username, account_status from dba_users where username = 'DEMO_APP';
Output:
User DEMO_APP dropped. User DEMO_APP created. Grant succeeded. User DEMO_APP altered. USERNAME ACCOUNT_STATUS ___________ _________________ DEMO_APP EXPIRED
Example:
sqlplus -s -L demo_app/Demo_Pass_26@localhost:1521/FREEPDB1 < /dev/null
Output:
ERROR: ORA-28001: The account has expired. The password must be changed. Changing password for demo_app New password: Retype new password: ERROR: ORA-00988: missing or invalid passwords Password unchanged SP2-0751: Unable to connect to Oracle. Exiting SQL*Plus
SQL*Plus offers to change the password at once and prompts for the new one twice. In an interactive session, type it there; this run gave no input, so the change failed and SQL*Plus exited.
Fix: Set a New Password
The user changes it at the prompt, or an administrator sets one, which also ends the expired status:
Example:
-- an administrator sets a new password, which also ends the expiry alter user demo_app identified by "Demo_Pass_27"; select username, account_status from dba_users where username = 'DEMO_APP';
Output:
User DEMO_APP altered. USERNAME ACCOUNT_STATUS ___________ _________________ DEMO_APP OPEN
Example:
sqlplus -s -L demo_app/Demo_Pass_27@localhost:1521/FREEPDB1 <<'SQL' select user from dual; SQL
Output:
USER ---------- DEMO_APP
Check the Password Limits
Example:
select resource_name, limit from dba_profiles
where profile = 'DEFAULT'
and resource_name in ('PASSWORD_LIFE_TIME', 'PASSWORD_GRACE_TIME');Output:
RESOURCE_NAME LIMIT ______________________ ________ PASSWORD_LIFE_TIME 180 PASSWORD_GRACE_TIME 7
Under the DEFAULT profile here, passwords last 180 days, followed by a 7-day grace period in which logons still work, with a warning.
Things to Know
- Application accounts often use a separate profile whose PASSWORD_LIFE_TIME is UNLIMITED, with passwords rotated by a planned process instead.
- Many tools, such as SQL Developer, also offer a password change dialog when they receive ORA-28001.
- Setting the same password again may be refused when the profile limits PASSWORD_REUSE_MAX or PASSWORD_REUSE_TIME.
Related Guides
Conclusion
ORA-28001 means the password expired. Change it at the logon prompt, or have an administrator set a new one, and review the profile's PASSWORD_LIFE_TIME for accounts that should not expire unattended.
