{"record":{"id":"61653067dd07c35f","repo":"phacility/phabricator","slug":"the-password-you-entered-is-the-same-as-another-pa","errorCode":null,"errorMessage":"The password you entered is the same as another password associated with your account. Each password must be unique.","messagePattern":"The password you entered is the same as another password associated with your account\\. Each password must be unique\\.","errorType":"validation","errorClass":"PhabricatorAuthPasswordException","httpStatus":null,"severity":"warning","filePath":"src/applications/auth/engine/PhabricatorAuthPasswordEngine.php","lineNumber":130,"sourceCode":"\n    // If we're creating a brand new object (like registering a new user)\n    // and it does not have a PHID yet, it isn't possible for it to have any\n    // revoked passwords or colliding passwords either, so we can skip these\n    // checks.\n\n    $object = $this->getObject();\n\n    if ($object->getPHID()) {\n      if ($this->isRevokedPassword($password)) {\n        throw new PhabricatorAuthPasswordException(\n          pht(\n            'The password you entered has been revoked. You can not reuse '.\n            'a password which has been revoked. Choose a new password.'),\n          pht('Revoked'));\n      }\n\n      if (!$this->isUniquePassword($password)) {\n        throw new PhabricatorAuthPasswordException(\n          pht(\n            'The password you entered is the same as another password '.\n            'associated with your account. Each password must be unique.'),\n          pht('Not Unique'));\n      }\n    }\n\n    // Prevent use of passwords which are similar to any object identifier.\n    // For example, if your username is \"alincoln\", your password may not be\n    // \"alincoln\", \"lincoln\", or \"alincoln1\".\n    $viewer = $this->getViewer();\n    $blocklist = $object->newPasswordBlocklist($viewer, $this);\n\n    // Smallest number of overlapping characters that we'll consider to be\n    // too similar.\n    $minimum_similarity = 4;\n\n    // Add the domain name to the blocklist.","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/engine/PhabricatorAuthPasswordEngine.php#L112-L148","documentation":"The uniqueness check in checkNewPassword(): isUniquePassword() compares the new password against every other (non-revoked) password hash associated with the same object PHID. A hash match means the account would end up with two active identical passwords, which is rejected with 'Not Unique' as the field error.","triggerScenarios":"Adding a second password (e.g., a separate API or SSH-password entry) to an account where the value matches one already stored, or 'changing' a password to its current value on installs where the change path routes through the engine.","commonSituations":"Multi-password accounts (personal + machine passwords) where the user reuses the same secret; automation re-running setup with the same credential; password managers inserting the same generated value for two slots.","solutions":["Use a different, distinct password for each credential slot on the account.","If the intent was rotation, make sure the new value actually differs from all existing ones.","Catch PhabricatorAuthPasswordException and show the 'Not Unique' field error inline."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Pre-check uniqueness for existing accounts\nif ($object->getPHID() && !$engine->isUniquePassword($password)) {\n  $e_password = pht('Not Unique');\n  return $this->buildPasswordFormResponse($e_password);\n}","typeGuard":null,"tryCatchPattern":"try {\n  $engine->checkNewPassword($password, $confirm);\n} catch (PhabricatorAuthPasswordException $ex) {\n  if ($ex->getPasswordError() === pht('Not Unique')) {\n    // tell the user each credential slot needs a distinct password\n  }\n}","preventionTips":["Give each credential slot on an account its own distinct secret.","When adding secondary passwords, generate rather than retype the primary one.","Use isUniquePassword() proactively in custom multi-password flows."],"tags":["phabricator","password","validation","password-reuse","php"],"backgroundTag":"password-validation-failed","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}