Pinned
What to Do If Your Password Is Insecure
If you are receiving a warning that your password has appeared in a data breach from another site and is no longer secure, you will need to change your password to a stronger one before you can log back in.
If you are still logged in on any device, please make sure your email address is up to date before logging out or resetting your password, or you may lose access to your account.
Check below the cut for information on how to check or update your email address, and how to change or reset your password.
Posted: 20:45 UTC 31 July, 2026
Update on Blocked Logins
We have temporarily lifted the block preventing users from logging in to AO3 with an insecure password. If you have been receiving this message recently, please immediately do the following:
- Log in to your account using your compromised password.
- Verify that the email on your account is one that you have access to and that it is up to date. a. To do this, go to your Preferences page and select "Change Email" at the top of the page. Your email address will be listed on that page, next to "Current email". b. If you don't have access to this email account, update your email before you change your password. You don't need access to your old email address to change it to a new one, as long as you also know your current password. c. If you do have access to this email account, copy-paste the email address so that you can correctly enter it into the password reset form. If you do not enter your email address exactly as it is listed here, you will not receive the password reset email.
- Change your password to a unique, strong password by following the steps in our Archive FAQ: How do I change my password? a. We strongly recommend that you use a password generator to select a new password. Most browsers and devices have a built-in password generator, or you can use this one: 1Password's Password Generator. b. Use a password manager to set and remember your passwords for you. If you don't want to install third-party software, you can use the password manager provided by your browser or device.
If you are still unable to access your account, you will need to work with Support to complete the account recovery process described in the previous post. Please provide them with your username and the name of the email account you have lost access to. You must wait at least a week so that Support can check that the original email address is truly inactive, and provide multiple forms of evidence that the account is truly yours. The account recovery process will not proceed if you are unable to provide sufficient proof that you are the owner of the account.
Posted: 14:42 UTC 4 August, 2026
