Envato Market rejects passwords that are weak, too common, or found in known data breaches — this happens automatically to protect your account, even if the password meets basic length requirements.
Why was my password rejected?
Every password is checked for strength and security before it's accepted. Common reasons a password gets rejected include:
- It's a weak or common combination (e.g., abc123, p@ssw0rd, password123).
- It's a variation of an Envato term, your username, or account details (e.g., themeforest123).
- It's too short or otherwise insecure.
- It's been exposed in a data breach outside of Envato.
What does "found in public lists of insecure passwords" mean?
This message means your chosen password has appeared in a known public data breach — once a password is breached, it's considered compromised and unsafe to reuse, since attackers commonly try leaked passwords across other sites.
To check this safely, we hash your password and send only a small fragment of that hash to Have I Been Pwned, which returns possible matches — your actual password is never shared. You can read more about how this anonymity guarantee works.
How do I create a strong, accepted password?
- Use a mix of uppercase, lowercase, and numbers — a password generator can help.
- Choose a unique password you don't reuse on other sites.
- Change your password periodically.
- Never share your password with anyone.
Password managers like 1Password or LastPass can generate and securely store strong, unique passwords for every account you use.