{"record":{"id":"5721d656cadee4cf","repo":"phacility/phabricator","slug":"the-password-you-entered-has-been-revoked-you-can","errorCode":null,"errorMessage":"The password you entered has been revoked. You can not reuse a password which has been revoked. Choose a new password.","messagePattern":"The password you entered has been revoked\\. You can not reuse a password which has been revoked\\. Choose a new password\\.","errorType":"validation","errorClass":"PhabricatorAuthPasswordException","httpStatus":null,"severity":"warning","filePath":"src/applications/auth/engine/PhabricatorAuthPasswordEngine.php","lineNumber":122,"sourceCode":"\n    if (PhabricatorCommonPasswords::isCommonPassword($raw_password)) {\n      throw new PhabricatorAuthPasswordException(\n        pht(\n          'The selected password is very weak: it is one of the most common '.\n          'passwords in use. Choose a stronger password.'),\n        pht('Very Weak'));\n    }\n\n    // If we're creating a brand new object (like registering a new user)\n    // and it does not have a PHID yet, it isn't possible for it to have any\n    // revoked passwords or colliding passwords either, so we can skip these\n    // checks.\n\n    $object = $this->getObject();\n\n    if ($object->getPHID()) {\n      if ($this->isRevokedPassword($password)) {\n        throw new PhabricatorAuthPasswordException(\n          pht(\n            'The password you entered has been revoked. You can not reuse '.\n            'a password which has been revoked. Choose a new password.'),\n          pht('Revoked'));\n      }\n\n      if (!$this->isUniquePassword($password)) {\n        throw new PhabricatorAuthPasswordException(\n          pht(\n            'The password you entered is the same as another password '.\n            'associated with your account. Each password must be unique.'),\n          pht('Not Unique'));\n      }\n    }\n\n    // Prevent use of passwords which are similar to any object identifier.\n    // For example, if your username is \"alincoln\", your password may not be\n    // \"alincoln\", \"lincoln\", or \"alincoln1\".","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/engine/PhabricatorAuthPasswordEngine.php#L104-L140","documentation":"For objects that already exist (they have a PHID), checkNewPassword() calls isRevokedPassword(): every prior password hash on the account that was revoked is compared against the new password. A match throws with 'Revoked' as the field error, preventing a compromised-then-revoked password from being re-selected and effectively re-activating old credentials.","triggerScenarios":"Calling checkNewPassword() on an existing PhabricatorUser (or other password-holding object) where the new password matches any password previously stored on that account whose revocation flag is set - typical in 'change password after incident' flows where the user tries to switch back to an old value.","commonSituations":"Users cycling between two favorite passwords; rotating back after a forced reset; revoked passwords retained by policy so old hashes keep blocking reuse.","solutions":["Pick a genuinely new password that has never been used on the account.","If policy allows, an administrator can revoke/delete the old password hash records so it no longer blocks (security trade-off - usually not recommended).","Use a password manager to avoid reuse patterns."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Pre-check revoked hashes when the object already exists\nif ($object->getPHID() && $engine->isRevokedPassword($password)) {\n  $e_password = pht('Revoked');\n  return $this->buildPasswordFormResponse($e_password);\n}","typeGuard":null,"tryCatchPattern":"try {\n  $engine->checkNewPassword($password, $confirm);\n} catch (PhabricatorAuthPasswordException $ex) {\n  if ($ex->getPasswordError() === pht('Revoked')) {\n    // explain the old password was revoked and cannot be reused\n  }\n}","preventionTips":["Treat password rotation as forward-only; never cycle back to old values.","Use a password manager so 'new' really is new.","When writing custom password flows, call isRevokedPassword() up front for existing objects."],"tags":["phabricator","password","validation","revoked-password","php"],"backgroundTag":"password-validation-failed","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}