Skip to main content

​
Troubleshooting: password rejected during password reset

When you open a password reset link and submit a new password, the form can refuse it with one of two messages:
This password has been seen in known data breaches. Please choose another.
This password doesn’t meet our security requirements. Please choose a stronger one.
Both are validation rejections (HTTP 422) on the password you submitted, not a server fault: nothing is broken, and nothing about your account changed. Your reset link is still valid, so you can submit a different password from the same link without requesting a new email.

​
What each message means

  • Breach-list rejection. The password you submitted appears in lists of passwords exposed in known data breaches. This says nothing about your account: it means the password itself is too public to reuse anywhere, even if you never caused the breach.
  • Security-requirements rejection. The password does not meet the baseline strength rules that apply to every Orbit sign-in. Length is the main lever: a long passphrase passes where a short complex string fails.

​
Why the reset rejects the password

Every password set on Orbit, including one set through a reset link, is checked at submit time against the known-breach lists and the baseline rules. When the check fails, the reset answers with a 422 validation error that names the reason, your existing password keeps working, and the reset link stays open until it expires. Submitting the same password again returns the same rejection, so the fix is a different password, not another attempt with the same one.

​
Choose a password that passes

  1. Pick a password that is not in circulation: one you have not used on any other service and have not used before. A password generated by a password manager always clears the breach screening.
  2. Make it long. Four unrelated words beat a short string of symbols, and length is what the baseline rules reward.
  3. Submit it from the same reset link. You do not need a new email.
These checks are Orbit-controlled. They are part of the platform’s sign-in baseline and apply to every member of every organization; there is no per-organization setting, and owners and administrators cannot weaken or skip them for a member. That is deliberate: a reset that could be exempted from breach screening would be a reset an attacker could exempt too.

​
Not the same as ACCOUNT_LOCKED

A policy rejection and a locked account fail at different places and are fixed differently:
  • The policy rejection appears on the reset form, when you submit a new password. It refuses that one password, leaves your account untouched, and does not count as a failed sign-in attempt.
  • ACCOUNT_LOCKED (403) appears on the sign-in form and refuses every sign-in until the lock clears, even with the correct password. A password reset does not clear it.
If you hit both, clear the lock first, then rotate the password. The lock page’s password reset path covers when rotation is the right move after a lock.

​
See also