> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshooting: password rejected during password reset

> The reset form refused your new password with 'This password has been seen in known data breaches' or a security-requirements message. Why that is a validation rejection rather than an outage, and how to choose a password that passes.

# Troubleshooting: password rejected during password reset

When you open a password reset link and submit a new password, the form can
refuse it with one of two messages:

> This password has been seen in known data breaches. Please choose another.

> This password doesn't meet our security requirements. Please choose a stronger one.

Both are validation rejections (HTTP 422) on the password you submitted, not
a server fault: nothing is broken, and nothing about your account changed.
Your reset link is still valid, so you can submit a different password from
the same link without requesting a new email.

## What each message means

* **Breach-list rejection.** The password you submitted appears in lists of
  passwords exposed in known data breaches. This says nothing about your
  account: it means the password itself is too public to reuse anywhere,
  even if you never caused the breach.
* **Security-requirements rejection.** The password does not meet the
  baseline strength rules that apply to every Orbit sign-in. Length is the
  main lever: a long passphrase passes where a short complex string fails.

## Why the reset rejects the password

Every password set on Orbit, including one set through a reset link, is
checked at submit time against the known-breach lists and the baseline
rules. When the check fails, the reset answers with a 422 validation
error that names the reason, your existing password keeps working, and the
reset link stays open until it expires. Submitting the same password again
returns the same rejection, so the fix is a different password, not another
attempt with the same one.

## Choose a password that passes

1. Pick a password that is not in circulation: one you have not used on
   any other service and have not used before. A password generated by a
   password manager always clears the breach screening.
2. Make it long. Four unrelated words beat a short string of symbols, and
   length is what the baseline rules reward.
3. Submit it from the same reset link. You do not need a new email.

These checks are Orbit-controlled. They are part of the platform's
sign-in baseline and apply to every member of every organization; there is
no per-organization setting, and owners and administrators cannot weaken
or skip them for a member. That is deliberate: a reset that could be
exempted from breach screening would be a reset an attacker could exempt
too.

## Not the same as ACCOUNT\_LOCKED

A policy rejection and a locked account fail at different places and are
fixed differently:

* The policy rejection appears on the **reset form**, when you submit a new
  password. It refuses that one password, leaves your account untouched,
  and does not count as a failed sign-in attempt.
* `ACCOUNT_LOCKED` (403) appears on the **sign-in form** and refuses every
  sign-in until the lock clears, even with the correct password. A
  password reset does not clear it.

If you hit both, clear the lock first, then rotate the password. The lock
page's [password reset
path](/troubleshooting/account-locked-login#password-reset-path) covers
when rotation is the right move after a lock.

## See also

* [Troubleshooting: ACCOUNT\_LOCKED at dashboard
  sign-in](/troubleshooting/account-locked-login) — the sign-in lock this
  page is not about, and the unlock paths for each lock class.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.