# Force password change after login
**URL:** https://meta.discourse.org/t/force-password-change-after-login/85202
**Category:** Support
**Created:** [April 13, 2018, 12:11am UTC](https://meta.discourse.org/t/force-password-change-after-login/85202 "2018-04-13T00:11:09Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@eatcodetravel](https://meta.discourse.org/u/eatcodetravel)
#### Post date: [April 13, 2018, 12:11am UTC](https://meta.discourse.org/t/force-password-change-after-login/85202/1 "2018-04-13T00:11:09Z")
Hello,
I’m migrating a forum to Discourse. I’m using the same approach as the discourse-migratepassword plugin to allow users to log in with their current password, but these passwords may be insecure.
I want to allow the users to log in but force them to change their password after login if doesn’t comply with Discourse’s password settings.
Is there a way to currently do this? If not, where I should look at to implement this as a plugin?
Thanks!
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [April 13, 2018, 1:16am UTC](https://meta.discourse.org/t/force-password-change-after-login/85202/2 "2018-04-13T01:16:10Z")
Sounds like it would be useful as an option on the discourse-migratepassword plugin. Slightly surprised it isn’t already.
---
### Author:  [@eatcodetravel](https://meta.discourse.org/u/eatcodetravel)
#### Post date: [April 13, 2018, 2:20am UTC](https://meta.discourse.org/t/force-password-change-after-login/85202/3 "2018-04-13T02:20:03Z")
Yeah, we can use that in the plugin too, happy to contribute that back if I implement it.
I was thinking in adding a custom\_field to the user and render an alert until the user changes their password, but forcing them to change it sounds like a better option (not sure where to look to achieve this)
---
### Author:  [@eatcodetravel](https://meta.discourse.org/u/eatcodetravel)
#### Post date: [April 17, 2018, 11:18pm UTC](https://meta.discourse.org/t/force-password-change-after-login/85202/4 "2018-04-17T23:18:59Z")
Well, I’m not forcing users to change their password, but we are rendering an alert on every login until they do so.
I’m setting a `user.custom_fields['migratepassword_policy'] = true` if the password doesn’t comply with Discourse settings and using that to conditionally render the modal, and we also send a password reset email once after they log in for the first time (with the insecure password)
What do you guys think?
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [April 17, 2018, 11:22pm UTC](https://meta.discourse.org/t/force-password-change-after-login/85202/5 "2018-04-17T23:22:10Z")
I think it was enabled without an option in the past - if your password was too short, you were required to do a password reset instead.
The policy was flipped because this was locking people out of their accounts (dead email accounts).
---
### Author:  [@eatcodetravel](https://meta.discourse.org/u/eatcodetravel)
#### Post date: [April 17, 2018, 11:26pm UTC](https://meta.discourse.org/t/force-password-change-after-login/85202/6 "2018-04-17T23:26:20Z")
Yeah, in this case we allow users to get into the platform with their current password, but we will render that modal until they change it (they can click OK or click outside the modal and it will close)
Maybe adding a “contact support if you don’t have access to your email anymore” message will do in case of dead email accounts
---
### Author:  [@q16marvin](https://meta.discourse.org/u/q16marvin)
#### Post date: [December 1, 2020, 1:44pm UTC](https://meta.discourse.org/t/force-password-change-after-login/85202/7 "2020-12-01T13:44:38Z")
hey exaktly the same we also need, we will create users via api and a default password… after user loged in first time, he should change his pass…
how did you do that?
Thx!
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [December 2, 2020, 7:44pm UTC](https://meta.discourse.org/t/force-password-change-after-login/85202/8 "2020-12-02T19:44:04Z")
Instead of creating a user with a default password you should create the user with a random password and never send it to them. Then they can use the forgot password link on the login page to reset their password first before logging in.
---
### Author:  [@q16marvin](https://meta.discourse.org/u/q16marvin)
#### Post date: [December 2, 2020, 10:58pm UTC](https://meta.discourse.org/t/force-password-change-after-login/85202/9 "2020-12-02T22:58:51Z")
99% our users have no mail address ^^ and we dont want do add so much mails only for “pass forget mails”
is there no other way instead using real mails?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [December 9, 2020, 5:31pm UTC](https://meta.discourse.org/t/force-password-change-after-login/85202/10 "2020-12-09T17:31:16Z")
That will be a big problem as email is considered identity in Discourse…
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [December 9, 2020, 5:47pm UTC](https://meta.discourse.org/t/force-password-change-after-login/85202/11 "2020-12-09T17:47:18Z")
If you want to have complete control over the login process in order to comply with your standard, I recommend using [Official Single-Sign-On for Discourse (sso)](https://meta.discourse.org/t/official-single-sign-on-for-discourse-sso/13045).
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [October 22, 2024, 12:20am UTC](https://meta.discourse.org/t/force-password-change-after-login/85202/12 "2024-10-22T00:20:51Z")
Discourse now supports the native ability to **expire** passwords.
To do so you will need to run:
```plaintext
user = User.find_by_username(username)
UserPasswordExpirer.expire_user_password(user)
```
This can be done either by Discourse staff for hosted customers or by entering your container, running a rails console and executing this on the particular users.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [November 21, 2024, 12:21am UTC](https://meta.discourse.org/t/force-password-change-after-login/85202/13 "2024-11-21T00:21:32Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.