2 Real 2 Funnious

Companies like Apple say the password has to have a capital lowercase number and 8+ characters. But leave out that your password can't be something you have used in the last year, can't contain your name, birthday, or email address. Those errors will come up separately. In this case it would say you can't reuse your password. It doesn't say your last password because it wasnt your last password. Some people just don't use the password daily/weekly, so they forget 6 times a year and have to keep resetting it.

Also the number of people forget their passcode because they use face/touch id all all the time is higher than you'd expect apparently. I knew someone who used to complain about it when they did support for them. Essentially people plug their device in every night, use it daily and never turn it off so it always accepts face or touch. Then they leave automatic updates on .. and it restarts for an update and they can't get back into their device because face/touch doesn't work on first boot, it is a subsidiary of the passcode and cannot be set up without the passcode.

Then since they forgot their passcode, they have to wipe everything from the phone to bypass it... But of course they don't know their password so they can't sign back into their account and it is then activation locked because that's how they prevent people from using stolen devices.

Then the extreme cases dude was telling me at that point is they changed their phone number at some point, so they can't reset their password without it, it takes days if not a week to recover the account, all the while their phone is a brick

Armis did this to me. I use Bitwarden, I know my password was right.

The time and attendance software at my old job would do that. It took me a while to figure out that it wasn't me forgetting the password, the password had just expired. Extremely frustrating.

Came here to say this.

Pretty sure most of the time the password is expired or invalidated, as you said, but whoever vibe coded the system was too lazy, too dumb, or too terrified of being blamed for the frustration of changing a password, that they think it is better to put ALL the frustration on the user.

Whatever the reason, I fucking hate them.

Password1

Password2

Password3

Password4

Password5

Password1

Aaaaaaaand repeat.

That one is okay-ish. The one that is going to have me getting in the elevator with my samurai sword to go and have a chat with somebody is "Your password cannot contain any sequence of characters from previous passwords," or "password cannot be your old password backwards."

Sure, just admit to me that you're storing passwords in plain text as carefree as you like.

Some sites have a character limit they don't tell you about. They accept the password when you make it, but they also chopped off the last 10 characters.

Yes?

Incorrect Password

They invalidate it because they got hacked or they fucked up some other way but they don’t want to admit it, so they don’t tell you about it and they act like the user is wrong.

Current best practice in cybersecurity is to not arbitrarily ask users to change passwords every x days, so any site doing this are following old guidelines.

Static password with good 2FA is the way to go.

Append the year and month to the password.

What the fuck are you expecting from me?

PasswordSpring2026!