# Supabase Auth: same_password

> Supabase updateUser fails with same_password: the new password matches the current one. Ask for a different password, and stop sending it when unchanged.

Canonical: https://app369.com/fix/supabase-same-password/
Last updated: 2026-11-09

same_password is the Supabase Auth error when updateUser sets a password that matches the user’s current one. It comes up in password reset forms and in profile screens that send the password field on every save.

**Short answer**

Show a clear message on the reset form asking for a different password. On profile screens, only include password in updateUser when the user typed a new one. Set autocomplete to new-password so the browser doesn’t fill in the current password.

Rather not fix it yourself? [**App Fix Ticket**](https://app369.com/fixed-price/flutter-firebase-bug-fix/) starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.

## **Why Supabase rejects the new password, and the fix**

1. 01 ### **The user typed the old password**
  > “A user that is updating their password must use a different password than the one currently used.” [**Supabase docs, Auth error codes (same_password)**](https://supabase.com/docs/guides/auth/debugging/error-codes) After a reset link, many users try the password they remember. Catch the code and ask for a new one.```
const { error } = await supabase.auth.updateUser({ password: newPassword });
if (error?.code === 'same_password') {
  showMessage('Choose a password different from your current one.');
}
```
2. 02 ### **The profile form always sends the password** A settings screen that passes the password on every save fails when only the name changed. Leave password out unless the field was edited.
3. 03 ### **The browser filled in the current password** Autofill can put the saved password into the new-password field. Mark the field with autocomplete set to new-password.```
<input type="password" name="new-password" autocomplete="new-password" />
```
4. 04 ### **The current password is checked in the wrong place**
  > “If your app requires users to confirm their current password before setting a new one, you can pass current_password” [**Supabase docs, Password-based Auth (Verifying the current password)**](https://supabase.com/docs/guides/auth/passwords) Also check: to confirm the old password, pass current_password to updateUser (supabase-js v2.102.0 or newer) instead of signing in again on the client.

Checked against the vendor’s docs on November 9, 2026: [Supabase docs: Auth error codes](https://supabase.com/docs/guides/auth/debugging/error-codes); [Supabase docs: Password-based Auth](https://supabase.com/docs/guides/auth/passwords).

## **Rather hand it over?**

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

- [from $450**App Fix Ticket**One reproducible bug in an existing mobile or web app, diagnosed and fixed.**See scope and start**](https://app369.com/fixed-price/flutter-firebase-bug-fix/)
- [from $450**AI-Built App Rescue**A Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.****No issues worth fixing, no charge.**** If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.**See scope and start**](https://app369.com/fixed-price/ai-app-rescue/)

[**All 127 Fiverr reviews**](https://app369.com/reviews/)

Related: [**Supabase weak password**](https://app369.com/fix/supabase-auth-weak-password/) · [**Supabase email link invalid or expired**](https://app369.com/fix/supabase-email-link-invalid-or-expired/) · [**Supabase sms_send_failed**](https://app369.com/fix/supabase-sms-send-failed/) · [**Supabase PGRST200**](https://app369.com/fix/supabase-could-not-find-relationship-pgrst200/)

Questions

## **More on this error**

<details>

<summary>**Is the password changed anyway? **+</summary>

No. The request fails and the current password stays as it was.

</details>

<details>

<summary>**Does this reveal the user’s password? **+</summary>

Only to someone already signed in as that user, who can set a new password anyway. Keep the message neutral all the same.

</details>

<details>

<summary>**Can you fix it for me? **+</summary>

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.

</details>

A different error?

## **Describe it and get a written quote**

Send the error and what you were doing. You get a written scope, a fixed price and a timeline; Simon replies by email, usually within one business day.

[**Describe your problem **→](https://app369.com/contact/) [**All fixes**](https://app369.com/fix/)