Auth0 Flexible Password Policy Warning Occurs When Custom Password Reset Page Remains Disabled

Last Updated: Aug 21, 2026

Overview

A warning appears when enabling the Flexible Password Policy in Auth0 because custom HTML remains stored in the backend, even if the custom password reset page remains disabled. Resolving this requires clearing the stored HTML or updating the version requirements via the Management API. When attempting to enable the Flexible Password Policy, Auth0 displays the following warning message, even if Customize Password Reset Page remains disabled in the Branding > Universal Login > Core Configuration settings.

You are using a custom password reset page. To use customized translation strings for Lock messages, ensure the change-password version is set to 1.1 or later in the custom password reset page. To use a minimum password length independent of the legacy default values, ensure the change-password version is set to 1.5.1 or later and the password_complexity_options is added in the custom password reset page.

Applies To

Auth0
Flexible Password Policy
Universal Login
Custom Password Reset Page

Cause

Auth0 checks for the presence of stored custom HTML for the password reset page, rather than the status of the enablement toggle. Disabling the toggle in the Auth0 Dashboard stops Auth0 from using the custom page, but Auth0 does not delete the stored HTML. If any custom HTML exists in the change_password object, Auth0 raises the warning regardless of the toggle state.

Solution

What actions clear or update the stored custom HTML?

Confirm the presence of stored HTML and either clear the content or update the version requirements.

Use the Auth0 Management API to inspect the tenant settings by sending a GET request to the following endpoint.
```
GET https://<your-tenant>.auth0.com/api/v2/tenants/settings
```

Review the response and locate the change_password object to confirm if the html attribute contains content.

{
"change_password": {
  "enabled": false,
  "html": "<html>... (custom HTML still stored here) ...</html>"
}

Clear the stored custom HTML to remove the customization entirely, or update the stored custom HTML to meet the version requirements.

- Clear the stored custom HTML: Fully remove the customization by sending a PATCH request to the Auth0 Management API using the following endpoint and payload.
  
  PATCH https://<your-tenant>.auth0.com/api/v2/tenants/settings
  
  {
  
  "change_password": {
  
  "enabled": false,
  
  "html": ""
  }

- Update the stored custom HTML: If the customization remains necessary, update the HTML to meet the version requirements. Set the change-password version to 1.1 or later for Lock message compatibility. Set the version to 1.5.1 or later and include password_complexity_options to enforce the minimum length of the Flexible Password Policy independently.