Introduction

When MySQL reports password expired and denies connection, the account must reset credentials before normal operations resume. This commonly appears with password expiration policies enabled in managed or security-hardened environments.

This article covers recovery options and preventive practices.

Core Sections

1) Detect expiration state

Typical message includes ERROR 1820 (HY000): You must reset your password using ALTER USER statement.

2) Connect with expired-password mode

mysql -u user -p --connect-expired-password

Allows login long enough to update password.

3) Reset password

ALTER USER 'user'@'%' IDENTIFIED BY 'NewStrongPassword!123';

Then reconnect normally.

4) Admin reset flow

If account cannot log in at all, privileged admin can reset:

ALTER USER 'user'@'%' IDENTIFIED BY 'TempPass!123';

User then rotates credential securely.

5) Policy and automation

Review default_password_lifetime and account-specific policies to align security with operations.

6) Production checklist for database credential recovery

A correct code snippet is only the baseline. To make this approach durable in production, define explicit acceptance checks around correctness, reliability, and operational behavior. Correctness means the output should match known-good fixtures for both normal and edge-case inputs. Reliability means failures are predictable and observable, with clear error messages and no silent degradation paths. Operational behavior means the implementation performs within expected latency and resource usage under realistic load, not only under tiny test data. Teams that skip this validation layer often ship logic that appears correct in local testing but fails under real traffic or environmental differences.

Document assumptions near the implementation: runtime version, dependency versions, required environment variables, and external system expectations. Many regressions are caused by version drift or configuration changes, not by algorithmic mistakes. If this workflow depends on filesystem paths, network resources, security credentials, or framework defaults, codify those requirements in code comments or adjacent documentation so they are visible during review. Add one deterministic smoke test that executes this path end-to-end and one failure-mode test that proves errors are surfaced with enough context for quick triage.

A practical release sequence is:

1. Run static checks and unit tests in CI.
2. Execute a smoke test with representative input shape and size.
3. Trigger one expected failure mode and verify logs/metrics.
4. Deploy with staged rollout or feature flag where possible.
5. Monitor stabilization metrics before broad rollout.

1# Example delivery workflow
2make lint
3make test
4./scripts/smoke_check.sh

Ownership and rollback should also be explicit. Define who responds when this component fails, what thresholds trigger rollback, and which fallback behavior is acceptable for users. If the workflow is business-critical, keep a concise runbook that includes common failure signatures and first-response steps. This reduces mean time to recovery and prevents repeated rediscovery of the same diagnostics.

Finally, maintain a brief limitations note. State what this approach intentionally does not solve and where alternative patterns are preferred. This prevents accidental overuse and keeps architecture decisions grounded in explicit tradeoffs. Revisit this checklist after framework, runtime, or infrastructure upgrades because previously safe assumptions can change when defaults evolve.

Common Pitfalls

• Trying repeated login attempts without --connect-expired-password.
• Resetting password to value that violates server policy.
• Leaving temporary admin-set passwords unchanged.
• Disabling expiration globally without risk review.
• Storing new credentials insecurely after reset.

Summary

Expired MySQL passwords require explicit reset before access continues. Use expired-password connection mode, run ALTER USER, and align account policies with secure operational practices.

For long-term stability, keep one regression test and one smoke-check script tied to this workflow in CI, and re-run both after runtime or dependency upgrades. Document expected environment assumptions and known limits in the repository so responders can troubleshoot quickly without re-deriving baseline behavior during incidents.