I swear this is not just my imagination. This has happened to me a few times in the past few weeks.

I attended a instructor-led course at Salesforce HQ and we were provided with a trial account that we were asked to set to our own e-mail addresses but also set the password to an instructor-defined password so he could get into the accounts as needed. I set the password to what the instructor asked for. The next day, I tried to log in and the password repeatedly did not work. I reset the password, and when I tried to enter in the password that kept getting rejected, and the only password that's ever been on the account, it said I could not reuse an old password. This happened again on the third day of courses before settling down.

Just recently I generated a sandbox in a Salesforce org and created a new user in that sandbox. I set up my password and definitely knew what it was. I logged out, logged back in and the correct password was rejected. I reset my password, and when I attempted to set it to the password I thought was on the account but which it rejected, it said I could not reuse an old password.

Are the dwarves going crazy or something? Either I got the password right or I didn't, and if I didn't get it right, there's no reason the password I thought was right should be getting rejected as a duplicate old password. Is there some other explanation?

1 Answer 1


I've see this issue before, but the only somewhat lasting work around I've found is to create a permission set and mark it with "Password Never Expires."

See: Is it possible to have different password policies for different users?

Once in a while we have this happen to users in our org. I suspect Salesforce has some kind of 'password quality check' going on in the background, but I don't have any kind of official response from them about it. I suspect that if Salesforce detects there are too many people in one org using the same password it flags it as a security hazard, and forces people to set unique passwords.

Hope that is somewhat useful.

Edit: Adding 2 form authentication could possibly get you around it as well (though it would lock the instructor out). Salesforce wants each account to be as secure as possible.

  • Hmm... that could possibly explain it. I know not to reuse passwords across too many sites, but when I'm creating a whole bunch of dev / sandbox orgs I don't always choose unique passwords. Still it's pretty awful that it will just invalidate a password in the background without any explicit notice.
    – Charles T
    Oct 5, 2016 at 17:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.