phacility/phabricator · warning · PhabricatorAuthPasswordException

The password you entered is the same as another password ass

Error message

The password you entered is the same as another password associated with your account. Each password must be unique.

What it means

The uniqueness check in checkNewPassword(): isUniquePassword() compares the new password against every other (non-revoked) password hash associated with the same object PHID. A hash match means the account would end up with two active identical passwords, which is rejected with 'Not Unique' as the field error.

Source

Thrown at src/applications/auth/engine/PhabricatorAuthPasswordEngine.php:130

    // If we're creating a brand new object (like registering a new user)
    // and it does not have a PHID yet, it isn't possible for it to have any
    // revoked passwords or colliding passwords either, so we can skip these
    // checks.

    $object = $this->getObject();

    if ($object->getPHID()) {
      if ($this->isRevokedPassword($password)) {
        throw new PhabricatorAuthPasswordException(
          pht(
            'The password you entered has been revoked. You can not reuse '.
            'a password which has been revoked. Choose a new password.'),
          pht('Revoked'));
      }

      if (!$this->isUniquePassword($password)) {
        throw new PhabricatorAuthPasswordException(
          pht(
            'The password you entered is the same as another password '.
            'associated with your account. Each password must be unique.'),
          pht('Not Unique'));
      }
    }

    // Prevent use of passwords which are similar to any object identifier.
    // For example, if your username is "alincoln", your password may not be
    // "alincoln", "lincoln", or "alincoln1".
    $viewer = $this->getViewer();
    $blocklist = $object->newPasswordBlocklist($viewer, $this);

    // Smallest number of overlapping characters that we'll consider to be
    // too similar.
    $minimum_similarity = 4;

    // Add the domain name to the blocklist.

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Use a different, distinct password for each credential slot on the account.
2. If the intent was rotation, make sure the new value actually differs from all existing ones.
3. Catch PhabricatorAuthPasswordException and show the 'Not Unique' field error inline.

// Pre-check uniqueness for existing accounts
if ($object->getPHID() && !$engine->isUniquePassword($password)) {
  $e_password = pht('Not Unique');
  return $this->buildPasswordFormResponse($e_password);
}

try {
  $engine->checkNewPassword($password, $confirm);
} catch (PhabricatorAuthPasswordException $ex) {
  if ($ex->getPasswordError() === pht('Not Unique')) {
    // tell the user each credential slot needs a distinct password
  }
}

When it happens

Trigger: Adding a second password (e.g., a separate API or SSH-password entry) to an account where the value matches one already stored, or 'changing' a password to its current value on installs where the change path routes through the engine.

Common situations: Multi-password accounts (personal + machine passwords) where the user reuses the same secret; automation re-running setup with the same credential; password managers inserting the same generated value for two slots.

Related errors

• You must choose a password or skip this step.
• You must choose a password.
• The selected password is too short. Passwords must be a mini
• You must confirm the selected password.
• The password and confirmation do not match.

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/61653067dd07c35f. Report an issue: GitHub.