phacility/phabricator · warning · PhabricatorAuthPasswordException

The password you entered has been revoked. You can not reuse

Error message

The password you entered has been revoked. You can not reuse a password which has been revoked. Choose a new password.

What it means

For objects that already exist (they have a PHID), checkNewPassword() calls isRevokedPassword(): every prior password hash on the account that was revoked is compared against the new password. A match throws with 'Revoked' as the field error, preventing a compromised-then-revoked password from being re-selected and effectively re-activating old credentials.

Source

Thrown at src/applications/auth/engine/PhabricatorAuthPasswordEngine.php:122

    if (PhabricatorCommonPasswords::isCommonPassword($raw_password)) {
      throw new PhabricatorAuthPasswordException(
        pht(
          'The selected password is very weak: it is one of the most common '.
          'passwords in use. Choose a stronger password.'),
        pht('Very Weak'));
    }

    // If we're creating a brand new object (like registering a new user)
    // and it does not have a PHID yet, it isn't possible for it to have any
    // revoked passwords or colliding passwords either, so we can skip these
    // checks.

    $object = $this->getObject();

    if ($object->getPHID()) {
      if ($this->isRevokedPassword($password)) {
        throw new PhabricatorAuthPasswordException(
          pht(
            'The password you entered has been revoked. You can not reuse '.
            'a password which has been revoked. Choose a new password.'),
          pht('Revoked'));
      }

      if (!$this->isUniquePassword($password)) {
        throw new PhabricatorAuthPasswordException(
          pht(
            'The password you entered is the same as another password '.
            'associated with your account. Each password must be unique.'),
          pht('Not Unique'));
      }
    }

    // Prevent use of passwords which are similar to any object identifier.
    // For example, if your username is "alincoln", your password may not be
    // "alincoln", "lincoln", or "alincoln1".

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Pick a genuinely new password that has never been used on the account.
2. If policy allows, an administrator can revoke/delete the old password hash records so it no longer blocks (security trade-off - usually not recommended).
3. Use a password manager to avoid reuse patterns.

// Pre-check revoked hashes when the object already exists
if ($object->getPHID() && $engine->isRevokedPassword($password)) {
  $e_password = pht('Revoked');
  return $this->buildPasswordFormResponse($e_password);
}

try {
  $engine->checkNewPassword($password, $confirm);
} catch (PhabricatorAuthPasswordException $ex) {
  if ($ex->getPasswordError() === pht('Revoked')) {
    // explain the old password was revoked and cannot be reused
  }
}

When it happens

Trigger: Calling checkNewPassword() on an existing PhabricatorUser (or other password-holding object) where the new password matches any password previously stored on that account whose revocation flag is set - typical in 'change password after incident' flows where the user tries to switch back to an old value.

Common situations: Users cycling between two favorite passwords; rotating back after a forced reset; revoked passwords retained by policy so old hashes keep blocking reuse.

Related errors

• You must choose a password or skip this step.
• You must choose a password.
• The selected password is too short. Passwords must be a mini
• You must confirm the selected password.
• The password and confirmation do not match.

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/5721d656cadee4cf. Report an issue: GitHub.