ORA-28001: Password Expired in Oracle – Complete Step-by-Step Solution

Published: April 2026

Last Updated: July 2026

Reading Time: 12–15 Minutes

Applies To: Oracle Database 11g, 12c, 18c, 19c, 21c, 23ai, Oracle RAC, Oracle Data Guard, Oracle E-Business Suite, Oracle Cloud Infrastructure (OCI)

The ORA-28001: the password has expired error occurs when an Oracle database user attempts to log in using an expired password. Oracle automatically enforces password expiration based on the user's assigned profile and security policies to improve database security.

Although resetting the password usually resolves the issue, database administrators should also understand why the password expired, how Oracle password profiles work, and whether security policies need to be adjusted for production environments.

This comprehensive guide explains the causes of ORA-28001, demonstrates production-tested troubleshooting techniques, and shares best practices for managing Oracle user passwords securely.

Quick Solution

If you receive ORA-28001, verify the following:

Check whether the user password has expired.
Reset the user's password.
Review the assigned profile.
Verify PASSWORD_LIFE_TIME settings.
Check PASSWORD_GRACE_TIME.
Unlock the account if necessary.
Confirm the application uses the updated password.

In most cases, ORA-28001 is resolved by resetting the password and ensuring the application's connection credentials are updated.

What is ORA-28001?
Error Message
How Oracle Password Expiration Works
Password Lifecycle
Common Symptoms
Common Causes
Step-by-Step Solutions
Production Case Study
Best Practices
Frequently Asked Questions
Related Oracle Articles

What is ORA-28001?

ORA-28001 indicates that the user's password has exceeded the maximum password lifetime defined by the Oracle profile. Oracle blocks authentication until the password is changed.

This behavior is part of Oracle's built-in password management framework, which helps organizations enforce password rotation and comply with security standards.

The error commonly affects:

SQL*Plus users
Oracle SQL Developer
Oracle Enterprise Manager
Oracle E-Business Suite
JDBC applications
Oracle Instant Client
Application servers
Scheduled jobs using database credentials

Error Message

ORA-28001: the password has expired

Some client applications may display additional authentication messages, but the underlying cause is that Oracle requires the password to be changed before allowing a successful login.

How Oracle Password Expiration Works

Oracle controls password expiration through database profiles. Each user is assigned a profile that defines password-related policies such as password lifetime, reuse restrictions, grace period, failed login attempts, and account locking rules.

When the configured password lifetime expires, Oracle prevents normal authentication and raises ORA-28001 until the password is reset.

DBA Tip

Many production outages occur because application service accounts use passwords that expire unexpectedly. Always review password policies before deploying production applications.

Oracle Password Lifecycle

User Created

      │

      ▼

Password Assigned

      │

      ▼

PASSWORD_LIFE_TIME Countdown

      │

      ▼

Grace Period (Optional)

      │

      ▼

Password Expired

      │

      ▼

ORA-28001 Returned

      │

      ▼

Password Reset

      │

      ▼

Authentication Successful

Understanding this lifecycle helps administrators identify whether the issue is caused by normal password expiration or by administrative actions such as manually expiring a user's password.

Common Symptoms

Users cannot log in to Oracle Database.
Oracle SQL Developer authentication fails.
Application services stop connecting to the database.
Oracle E-Business Suite login failures occur.
Scheduled jobs fail after password expiration.
JDBC applications report authentication errors.
Database monitoring tools lose connectivity.

Common Causes

Password exceeded PASSWORD_LIFE_TIME.
Administrator manually expired the password.
Default profile enforces password expiration.
Service account password was never updated.
Password policy changes after database upgrade.
Application still uses the old password.
Password synchronization failed across environments.
Security compliance requires periodic password rotation.

Oracle Authentication Overview

When a user connects to Oracle, the database validates the username, password, account status, and assigned profile before establishing a session.

Client Application

      │

      ▼

Username

      │

      ▼

Password Verification

      │

      ▼

Profile Validation

      │

      ▼

Password Expiration Check

      │

      ▼

Account Status Check

      │

      ▼

Database Session

If Oracle detects that the password has expired during the authentication process, it immediately returns ORA-28001 and denies the login request.

Next: Part 2 covers step-by-step troubleshooting, SQL queries, password reset procedures, profile management, Oracle E-Business Suite considerations, and a real-world production case study.

Step-by-Step Solutions

Resolving ORA-28001: the password has expired involves identifying whether the password has expired due to profile settings, administrative action, or application configuration. Follow the steps below to diagnose and resolve the issue safely.

Solution 1 – Check the User Account Status

First, determine whether the user account is expired, locked, or both.

Execute the following query as a privileged user:

SELECT username,
       account_status,
       expiry_date,
       profile
FROM dba_users
WHERE username='SCOTT';

Typical account status values include:

OPEN
EXPIRED
EXPIRED(GRACE)
LOCKED
EXPIRED & LOCKED

DBA Recommendation

Always verify the account status before resetting passwords. An expired account may also be locked due to failed login attempts.

Solution 2 – Reset the User Password

The most common solution is to assign a new password.

ALTER USER scott IDENTIFIED BY NewPassword123;

The user should then reconnect using the updated password.

Solution 3 – Unlock the Account (If Required)

If the account is locked in addition to being expired, unlock it after changing the password.

ALTER USER scott
ACCOUNT UNLOCK;

Or perform both actions in a single command:

ALTER USER scott
IDENTIFIED BY NewPassword123
ACCOUNT UNLOCK;

Solution 4 – Check the Assigned Profile

Oracle password policies are controlled through database profiles. Determine which profile is assigned to the user.

SELECT username,
       profile
FROM dba_users
WHERE username='SCOTT';

Knowing the assigned profile helps determine why the password expired.

Solution 5 – Verify PASSWORD_LIFE_TIME

The PASSWORD_LIFE_TIME parameter specifies the number of days a password remains valid before Oracle expires it.

Check the current profile settings:

SELECT profile,
       resource_name,
       limit
FROM dba_profiles
WHERE resource_name='PASSWORD_LIFE_TIME';

Example output:

Profile	PASSWORD_LIFE_TIME
DEFAULT	180

Solution 6 – Review PASSWORD_GRACE_TIME

Oracle allows users to continue logging in during the grace period while displaying password expiration warnings.

Check the grace period:

SELECT profile,
       resource_name,
       limit
FROM dba_profiles
WHERE resource_name='PASSWORD_GRACE_TIME';

If the grace period has ended, Oracle returns ORA-28001 until the password is changed.

Solution 7 – Modify the Password Policy (If Appropriate)

Some service accounts require passwords that do not expire. If permitted by your organization's security policy, adjust the profile accordingly.

ALTER PROFILE DEFAULT
LIMIT PASSWORD_LIFE_TIME UNLIMITED;

Important: Avoid disabling password expiration for normal user accounts unless approved by your organization's security policy.

Solution 8 – Verify Application Credentials

After resetting the database password, ensure every application that uses the account is updated.

Examples include:

Oracle E-Business Suite
Oracle WebLogic
Oracle Forms and Reports
JDBC connection pools
Application configuration files
Shell scripts and batch jobs
Monitoring tools

Failure to update stored credentials can result in repeated login failures and account locking.

Solution 9 – Oracle E-Business Suite Considerations

Oracle E-Business Suite environments frequently use dedicated database accounts for application services. If one of these passwords expires, application services may fail to start or users may experience login issues.

Recommended checks:

Verify application schema passwords.
Update AutoConfig if required.
Confirm connection details in context files.
Restart affected application services after updating credentials.

EBS Best Practice

Before changing passwords for Oracle E-Business Suite schemas, review Oracle support documentation and follow your organization's password management procedures to avoid service interruptions.

Real Production Case Study

A production reporting application suddenly stopped connecting to the Oracle database after several months of normal operation.

Investigation revealed:

The database was available.
The application server was reachable.
The service account showed EXPIRED(GRACE) and later changed to EXPIRED.
The application continued using the old password.

Resolution:

Reset the service account password.
Updated the application configuration.
Restarted the application services.
Reviewed password expiration policies for service accounts.

Application connectivity was restored without requiring a database restart.

Quick Troubleshooting Checklist

Verification	Status
User Account Status Checked	☐
Password Reset	☐
Account Unlocked	☐
Assigned Profile Verified	☐
PASSWORD_LIFE_TIME Reviewed	☐
PASSWORD_GRACE_TIME Reviewed	☐
Application Credentials Updated	☐
Application Restarted	☐

Oracle Version Considerations

Although the ORA-28001 error exists across multiple Oracle Database releases, password management features have evolved over time. Understanding these differences helps database administrators troubleshoot authentication issues more effectively.

Oracle Version	Password Management Notes
Oracle 11g	Profile-based password expiration and account locking.
Oracle 12c	Supports Multitenant (CDB/PDB) architecture and enhanced password management.
Oracle 19c	Long Term Support (LTS) release with improved security recommendations.
Oracle 21c / 23ai	Continues profile-based password policies with enhanced cloud integration.

Oracle Multitenant (CDB/PDB) Considerations

In Oracle Multitenant environments, users may exist in different Pluggable Databases (PDBs). A password reset performed in one container does not automatically affect users in another unless they are common users.

Before resetting passwords, verify that you are connected to the correct container.

SHOW CON_NAME;

To view available PDBs:

SHOW PDBS;

DBA Tip

When troubleshooting ORA-28001 in a Multitenant environment, always verify whether the affected account is a common user or a local PDB user before making changes.

Common Mistakes

Resetting the password without checking the account status.
Ignoring the assigned profile and password policies.
Changing the password but forgetting to update application configuration files.
Disabling password expiration for all users without security approval.
Using weak passwords that violate Oracle password verification rules.
Ignoring PASSWORD_GRACE_TIME warnings.
Changing passwords directly in production without following change management procedures.
Resetting passwords in the wrong PDB in Multitenant databases.

Best Practices

Review password policies before deploying production applications.
Use dedicated profiles for application service accounts.
Monitor upcoming password expirations proactively.
Maintain secure password management procedures.
Update all application connection strings after changing passwords.
Use strong passwords that comply with organizational security standards.
Document password policy changes for audit purposes.
Regularly review inactive and expired accounts.

Frequently Asked Questions

What causes ORA-28001?

ORA-28001 occurs when the user's password has exceeded the password lifetime defined in the assigned Oracle profile or has been manually expired by an administrator.

How do I reset an expired Oracle password?

ALTER USER username
IDENTIFIED BY NewPassword123;

Can I disable password expiration?

Yes. Oracle allows password expiration to be disabled by modifying the profile, for example by setting PASSWORD_LIFE_TIME UNLIMITED. However, this should only be done when it aligns with your organization's security policy.

Why does my application still fail after resetting the password?

Most applications store database credentials in configuration files or connection pools. After changing the database password, update the application's stored credentials and restart any affected services if required.

What is the difference between ORA-28001 and ORA-01017?

ORA-28001 indicates that the password has expired. ORA-01017 indicates invalid authentication credentials. An expired password may eventually lead users to believe they have entered incorrect credentials, but the underlying causes are different.

About the Author

Rana Abdul Wahid is a seasoned Oracle Database Consultant with over 15 years of experience in Oracle Database Administration, Oracle E-Business Suite Application DBA, Oracle Cloud Infrastructure (OCI), Oracle RAC, Oracle Data Guard, RMAN Backup & Recovery, Performance Tuning, Linux/Unix Administration, MySQL, Microsoft SQL Server, PostgreSQL, and enterprise database management.

Through this blog, he shares practical Oracle DBA troubleshooting guides, production-tested solutions, Oracle security best practices, performance tuning techniques, and real-world experience to help database professionals solve complex Oracle issues efficiently.

Learn more about the author →

Conclusion

The ORA-28001: the password has expired error is a built-in Oracle security feature designed to enforce password lifecycle policies. Although the immediate solution is often to reset the password, administrators should also review password profiles, account status, and application configurations to prevent recurring authentication issues.

By understanding Oracle password policies, maintaining secure profile configurations, and proactively monitoring password expiration, DBAs can reduce unplanned outages while improving the overall security of Oracle database environments.

Final DBA Advice

Avoid simply disabling password expiration to eliminate ORA-28001. Instead, implement password policies that balance operational requirements with security best practices, especially for service accounts and enterprise applications.

Did this guide help resolve your ORA-28001 error? Bookmark this article and explore our complete Oracle Error Codes Guide for more production-tested Oracle DBA solutions.

Oracle Database Error Solutions & DBA Knowledge Base