About this block

Password Expired Page is the forced rotation gate reached at sign in when an org policy deadline has passed. The Acme lockup sits above a card headed Your password has expired, the signed-in address named in weight, a muted panel that states the exact policy (a change every 90 days, last changed 94 days ago) and calls it org policy rather than a breach, then the current and new password fields each with a plain helper line. An Update password and continue button leads, and a footer note lists what happens on save: two other sessions sign out, passkeys and API keys are untouched, and the next change is in 90 days. A reset by email link sits below the card.

The block is static; the policy panel is the piece that turns a confusing forced logout into an expected step. The last-changed date and the untouched credentials note are the two lines that stop a security ticket.

When to use

Reach for this block as the interstitial shown after a valid sign in when the account's password age exceeds the rotation policy. Wire the form to your change password endpoint and read the last-changed date and policy window from the account record.

A natural flow around it on an Application Pro page:

Before

• Nothing, the gate replaces sign in for that session

After

• Settings pages
• App shells

What you can display

One strong use is the scheduled rotation gate. Other forced-change variants:

• Admin-forced reset. Swap the policy line for a note that an admin required a change on this account.
• Breach response. State that the password appeared in a known leak and must be replaced now.
• First login change. Require a new password on the first sign in after an admin-provisioned account.

Tip: name the exact policy and the last-changed date; a forced change with no reason reads as a breach and sends the careful user straight to support.