@@ -0,0 +1,7 @@
+---
+'@clerk/localizations': patch
+'@clerk/shared': patch
+'@clerk/ui': patch
+---
+
+Display a proper message when a password is rejected for matching one of the account's identifiers. Previously this error rendered as the incomplete sentence "Your password must contain ." on sign-up, reset password, and the user profile password form. The new message is available under the `unstable__errors.form_password_matches_identifier` localization key, and any password error the UI does not recognize now falls back to the message returned by the API instead of an empty sentence.
@@ -1787,6 +1787,8 @@ export const enUS: LocalizationResource = {
     form_password_compromised__sign_in: undefined,
     form_password_incorrect: undefined,
     form_password_length_too_short: 'Your password is too short. It must be at least 8 characters long.',
+    form_password_matches_identifier:
+      'Password cannot match your email address, phone number or username. For account safety, please use a different password.',
     form_password_not_strong_enough: 'Your password is not strong enough.',
     form_password_or_identifier_incorrect: undefined,
     form_password_pwned:
 
@@ -2158,6 +2158,7 @@ type UnstableErrors = WithParamName<{
   form_password_pwned: LocalizationValue;
   form_password_pwned__sign_in: LocalizationValue;
   form_new_password_matches_current: LocalizationValue;
+  form_password_matches_identifier: LocalizationValue;
   /** @deprecated Use `form_password_compromised__sign_in` instead */
   form_password_untrusted__sign_in: LocalizationValue;
   form_password_compromised__sign_in: LocalizationValue;
 
@@ -161,6 +161,65 @@ describe('createPasswordError() constructs error that password', () => {
     );
   });
 
+  it('matches one of the account identifiers', async () => {
+    const { wrapper: Wrapper } = await createFixtures();
+
+    const wrapperBefore = ({ children }) => (
+      <Wrapper>
+        <OptionsProvider value={{ localization: {} }}>{children}</OptionsProvider>
+      </Wrapper>
+    );
+
+    const { result } = renderHook(() => useLocalizations(), { wrapper: wrapperBefore });
+
+    const res = createPasswordError(
+      [{ code: 'form_password_matches_identifier', message: 'server message' }],
+      createLocalizationConfig(result.current.t),
+    );
+    expect(res).toBe(
+      'Password cannot match your email address, phone number or username. For account safety, please use a different password.',
+    );
+  });
+
+  it('falls back to the server message for a code with no complexity mapping', async () => {
+    const { wrapper: Wrapper } = await createFixtures();
+
+    const wrapperBefore = ({ children }) => (
+      <Wrapper>
+        <OptionsProvider value={{ localization: {} }}>{children}</OptionsProvider>
+      </Wrapper>
+    );
+
+    const { result } = renderHook(() => useLocalizations(), { wrapper: wrapperBefore });
+
+    const res = createPasswordError(
+      [{ code: 'form_password_some_future_rule', message: 'Server explains the rule.' }],
+      createLocalizationConfig(result.current.t),
+    );
+    expect(res).toBe('Server explains the rule.');
+  });
+
+  it('ignores unmapped codes that accompany a mapped one', async () => {
+    const { wrapper: Wrapper } = await createFixtures();
+
+    const wrapperBefore = ({ children }) => (
+      <Wrapper>
+        <OptionsProvider value={{ localization: {} }}>{children}</OptionsProvider>
+      </Wrapper>
+    );
+
+    const { result } = renderHook(() => useLocalizations(), { wrapper: wrapperBefore });
+
+    const res = createPasswordError(
+      [
+        { code: 'form_password_no_uppercase', message: '' },
+        { code: 'form_password_some_future_rule', message: 'Server explains the rule.' },
+      ],
+      createLocalizationConfig(result.current.t),
+    );
+    expect(res).toBe('Your password must contain an uppercase letter.');
+  });
+
   //
   // zxcvbn
   //
 
@@ -40,7 +40,8 @@ export const createPasswordError = (errors: ClerkAPIError[], localizationConfig:
   if (
     errors?.[0]?.code === 'form_password_size_in_bytes_exceeded' ||
     errors?.[0]?.code === 'form_password_pwned' ||
-    errors?.[0]?.code === 'form_new_password_matches_current'
+    errors?.[0]?.code === 'form_new_password_matches_current' ||
+    errors?.[0]?.code === 'form_password_matches_identifier'
   ) {
     return `${t(localizationKeys(`unstable__errors.${errors?.[0]?.code}` as any)) || errors?.[0]?.message}`;
   }
@@ -58,8 +59,16 @@ export const createPasswordError = (errors: ClerkAPIError[], localizationConfig:
   // show min length error first by itself
   const minLenErrors = errors.filter(e => e.code === 'form_password_length_too_short');
 
-  const message = (minLenErrors.length ? minLenErrors : errors).map((s: any) => {
-    const localizedKey = (mapComplexityErrors(passwordSettings) as any)[s.code];
+  const complexityErrors = mapComplexityErrors(passwordSettings);
+  const knownErrors = (minLenErrors.length ? minLenErrors : errors).filter(e => e.code in complexityErrors);
+
+  // an unmapped code would otherwise render the prefix with an empty list, eg "Your password must contain ."
+  if (!knownErrors.length) {
+    return errors?.[0]?.longMessage || errors?.[0]?.message || '';
+  }
+
+  const message = knownErrors.map((s: any) => {
+    const localizedKey = (complexityErrors as any)[s.code];
 
     if (Array.isArray(localizedKey)) {
       const [lk, attr, val] = localizedKey;