ORA-28001: the password has expired

The account’s password passed its PASSWORD_LIFE_TIME. Change the password. For application accounts, update it everywhere it is stored, and use a profile that fits a service account.

What ORA-28001 means

Profiles can limit how long a password stays valid. After PASSWORD_LIFE_TIME and the optional grace period, logging in fails with ORA-28001 until the password is changed. In interactive tools you are usually asked for a new one; applications simply fail. A warning before that is ORA-28002.

Common causes of ORA-28001

The password reached PASSWORD_LIFE_TIME in the user’s profile.
An administrator expired it: ALTER USER … PASSWORD EXPIRE.
A service account on a default profile that was never meant to expire.
A new database whose default profile has a limit, unlike the old one.

How to fix ORA-28001

Change the password: ALTER USER app_user IDENTIFIED BY "…".
Update it wherever it is stored, otherwise the account will lock next (ORA-28000).
Check the limit: EXPIRY_DATE in DBA_USERS, and the profile in DBA_PROFILES.
For service accounts, a dedicated profile fits better than switching off expiry for everyone. Follow your security policy.

ORA-28001 example

When does it expire, and under which profile?

SELECT username, account_status, expiry_date, profile
  FROM dba_users
 WHERE username = 'APP_USER';

Change it:

ALTER USER app_user IDENTIFIED BY "New#Passw0rd";

In SQLlightspeed

When a statement fails, SQLlightspeed’s error panel shows the error code with a plain-language explanation and a suggestion for what to do next, together with Oracle’s own message and a link to Oracle’s documentation — for this error and dozens of other common ones.

Try SQLlightspeed free for 30 days

Oracle documentation for ORA-28001. Oracle is a registered trademark of Oracle Corporation. SQLlightspeed is not affiliated with Oracle.