I swear this is not just my imagination. This has happened to me a few times in the past few weeks.

I attended a instructor-led course at Salesforce HQ and we were provided with a trial account that we were asked to set to our own e-mail addresses but also set the password to an instructor-defined password so he could get into the accounts as needed. I set the password to what the instructor asked for. The next day, I tried to log in and the password repeatedly did not work. I reset the password, and when I tried to enter in the password that kept getting rejected, and the only password that's ever been on the account, it said I could not reuse an old password. This happened again on the third day of courses before settling down.

Just recently I generated a sandbox in a Salesforce org and created a new user in that sandbox. I set up my password and definitely knew what it was. I logged out, logged back in and the correct password was rejected. I reset my password, and when I attempted to set it to the password I thought was on the account but which it rejected, it said I could not reuse an old password.

Are the dwarves going crazy or something? Either I got the password right or I didn't, and if I didn't get it right, there's no reason the password I thought was right should be getting rejected as a duplicate old password. Is there some other explanation?

1 Answer 1


I've see this issue before, but the only somewhat lasting work around I've found is to create a permission set and mark it with "Password Never Expires."

See: Is it possible to have different password policies for different users?

Once in a while we have this happen to users in our org. I suspect Salesforce has some kind of 'password quality check' going on in the background, but I don't have any kind of official response from them about it. I suspect that if Salesforce detects there are too many people in one org using the same password it flags it as a security hazard, and forces people to set unique passwords.

Hope that is somewhat useful.

Edit: Adding 2 form authentication could possibly get you around it as well (though it would lock the instructor out). Salesforce wants each account to be as secure as possible.

  • Hmm... that could possibly explain it. I know not to reuse passwords across too many sites, but when I'm creating a whole bunch of dev / sandbox orgs I don't always choose unique passwords. Still it's pretty awful that it will just invalidate a password in the background without any explicit notice.
    – Charles T
    Oct 5, 2016 at 17:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .