Oracle Error ORA-28001

Error code

ORA-28001

Product

Oracle Database

Versions

Oracle Database 19c, 21c, 23ai and 26ai (wording differs: see below)

Category

Logins, Accounts & Privileges

Last reviewed

24 October 2026

What it means

ORA-28001 means the password of the account has expired, so Oracle accepts the old password only to let you set a new one, and the session cannot be used until the password is changed.

Oracle's reference gives four ways an account expires: an administrator expired it (ALTER USER ... PASSWORD EXPIRE); its profile has a limited PASSWORD_LIFE_TIME and the password was not changed in time; the account came in with a database import into a PDB or a PDB clone; or the password does not meet the mandatory profile enforced in the PDB. The Action is to change the password, asking a DBA for the password rules if needed.

Expiry has two stages. When PASSWORD_LIFE_TIME is reached, the account enters a grace period of PASSWORD_GRACE_TIME days (ACCOUNT_STATUS EXPIRED(GRACE)): logons still work but return the warning ORA-28002. When the grace period ends, the status is EXPIRED and logons return ORA-28001. In CREATE PROFILE the defaults are 180 days for PASSWORD_LIFE_TIME and 7 days for PASSWORD_GRACE_TIME, although the DEFAULT profile itself may be set differently on your database.

DBA_USERS says an EXPIRED user can log in with the expired password and then change it. SQL*Plus prompts for a new password at logon; an application or connection pool usually cannot, so for service accounts ORA-28001 shows up as an application outage until someone changes the password.

Common causes

• The password reached the profile's PASSWORD_LIFE_TIME and the grace period (with its ORA-28002 warnings) passed unnoticed.
• A DBA created the user or reset its password with PASSWORD EXPIRE, so the first logon must set a new one.
• A service account used by an application or job is under a profile with a limited password life, and nobody rotated it.
• The account came with a database import into a PDB or a PDB clone, and its password does not satisfy the PDB's mandatory profile.

Diagnose it

Read-only These queries only read the data dictionary (USER_, ALL_ and DBA_ views) and dynamic performance views (V$). They do not change data, privileges or settings, so they are safe to run first. DBA_ and V$ views need the matching privileges.

SELECT username, account_status, expiry_date, password_change_date, profile
FROM dba_users
WHERE username = 'APP_USER';

SELECT profile, resource_name, limit
FROM dba_profiles
WHERE profile IN ('DEFAULT', (SELECT profile FROM dba_users WHERE username = 'APP_USER'))
  AND resource_name IN ('PASSWORD_LIFE_TIME', 'PASSWORD_GRACE_TIME', 'PASSWORD_VERIFY_FUNCTION')
ORDER BY profile, resource_name;

SELECT username, account_status, expiry_date, profile
FROM dba_users
WHERE expiry_date < SYSDATE + 30
  AND oracle_maintained = 'N'
ORDER BY expiry_date;

How to fix it

Each fix is labelled with what it changes. Try read-only checks and the least invasive fix first, and test changes outside production.

-- SQL*Plus
PASSWORD

-- or in SQL
ALTER USER app_user IDENTIFIED BY "New#Passw0rd-2026" REPLACE "Old#Passw0rd-2025";

ALTER USER app_user IDENTIFIED BY "New#Passw0rd-2026";

CREATE PROFILE app_service_profile LIMIT
  PASSWORD_LIFE_TIME    90
  PASSWORD_GRACE_TIME   14
  FAILED_LOGIN_ATTEMPTS 10
  PASSWORD_LOCK_TIME    1;

ALTER USER app_user PROFILE app_service_profile;

Examples

A new user created with an expired password

Not reproduced here: no Oracle Database is installed for this site. The message text is from Oracle's error reference for current releases; Oracle Database 19c and 21c print "the password has expired". SQL*Plus then asks for a new password; the user and service names are illustrative.

CREATE USER sara IDENTIFIED BY "Temp#Start-2026" PASSWORD EXPIRE;
GRANT CREATE SESSION TO sara;

-- Sara's first logon
CONNECT sara@//dbhost:1521/SALESPDB

ERROR:
ORA-28001: The account has expired. The password must be changed.

An application account whose grace period ran out

Not reproduced here: no Oracle Database is installed for this site. The message format is from Oracle's error reference; the life time and grace time are the defaults documented in CREATE PROFILE, and the timeline is illustrative.

-- APP_USER is under a profile with PASSWORD_LIFE_TIME 180 and PASSWORD_GRACE_TIME 7.
-- After 180 days the next logon starts the 7-day grace period: logons succeed
-- with the ORA-28002 warning, which the application ignores.
-- When the grace period ends, the connection pool opens a new connection

ORA-28001: The account has expired. The password must be changed.

How to prevent it

Monitor EXPIRY_DATE in DBA_USERS and rotate service account passwords before they expire. Treat ORA-28002 in application logs as an alert, not noise. Keep application credentials in one managed place so a rotation is one change.

Create human users with PASSWORD EXPIRE so they choose their own password at first logon, and keep password life limits in place: rotation with planning, not unlimited lifetimes.

Common questions

Learn more on CodeWithSQL

• SQL security

Official documentation

• ORA-28001 (Oracle Database Error Messages)
• CREATE PROFILE (Oracle SQL Language Reference 19c)
• ALTER USER (Oracle SQL Language Reference 19c)
• PASSWORD (SQL*Plus User's Guide and Reference 19c)

Last technically reviewed 24 October 2026; examples and diagnostics run on Oracle Database Error Messages reference (26ai, 21c and 19c); not run locally. Messages and explanations follow Oracle's Database Error Messages reference; no Oracle Database was available, so the examples were not run locally.