---
title: The password expiring and password expired controls
description: "The password expiring and password expired controls that the PingDirectory server supports and what each control indicates about a user's password state."
component: pingdirectory
version: 10.2
page_id: pingdirectory:pingdirectory_security_guide:pd_sec_pw_expire_controls
canonical_url: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_security_guide/pd_sec_authn_ctrls.html
llms_txt: https://docs.pingidentity.com/pingdirectory/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2023-09-13T00:00:00Z
---

# The password expiring and password expired controls

PingDirectory server supports the password expiring and password expired controls, as described in [draft-vchu-ldap-pwd-policy-00](https://docs.ldap.com/specs/draft-vchu-ldap-pwd-policy-00.txt).

The password expiring control can be included in the response to a successful bind attempt to indicate that the user's password is about to expire. Its value indicates the length of time until the password actually expires.

The password expired control can be included in the response to a successful or failed bind attempt to indicate that the user's password has expired and must be changed. If the bind operation was successful, then it means that the user must change their password before they are allowed to request any other operations. If the bind operation failed, then it means that the password must be reset before the user can access their account.