Server Handling of Expired Passwords The  ALTER USER  statement enables account password expiration. For example: For each connection that uses an account with an expired password, the server either disconnects the client or restricts the client to “sandbox mode,”  in which the server permits the client to perform only those operations necessary to reset the expired password. Which action is taken by the server depends on both client and server settings, as discussed later. If the server disconnects the client, it returns an  ER_MUST_CHANGE_PASSWORD_LOGIN  error: If the server restricts the client to sandbox mode, these operations are permitted within the client session: Although it is possible to “reset”  an expired password by setting it to its current value, it is preferable, as a matter of good policy, to choose a different password. DBAs can enforce non-reuse by establishing an appropriate password-reuse policy. See Password Reuse Policy. For any operation not permitted within the session, the server returns an  ER_MUST_CHANGE_PASSWORD error: That is what normally happens for interactive invocations of the  mysql  client because by default such invocations are put in sandbox mode. To resume normal functioning, select a new password. For noninteractive invocations of the  mysql  client (for example, in batch mode), the server normally disconnects the client if the password is expired. To permit noninteractive  mysql  invocations to stay connected so that the password can be changed (using the statements permitted in sandbox mode), add the  --connect-expired-password  option to the  mysql  command. As mentioned previously, whether the server disconnects an expired-password client or restricts it to sandbox mode depends on a combination of client and server settings. The following discussion describes the relevant settings and how they interact. This discussion applies only for accounts with expired passwords. If a client connects using a nonexpired password, the server handles the client normally. 1257 ALTER USER ’myuser’@’localhost’ PASSWORD EXPIRE; shell>  mysql -u myuser -p Password:  ****** ERROR 1862 (HY000): Your password has expired. To log in you must change it using a client that supports expired passwords. mysql>  USE performance_schema; ERROR 1820 (HY000): You must reset your password using ALTER USER statement before executing this statement. mysql>  SELECT 1; ERROR 1820 (HY000): You must reset your password using ALTER USER statement before executing this statement. •The client can reset the account password with  ALTER USER  or  SET PASSWORD . After that has been done, the server restores normal access for the session, as well as for subsequent connections that use the account. •Prior to MySQL 8.0.27, the client can use the  SET  statement. As of MySQL 8.0.27, this is no longer permitted. Note Note