The one login screen everybody hates

You know the moment. It’s Monday morning, you’re mid-task, and FileMaker stops you cold: password expired, change it now. No warning, no heads-up email, just a wall. Multiply that by a few dozen users and you’ve got a steady trickle of “why can’t I log in” messages in your inbox.

FileMaker has had password expiration built into Manage Security for as long as I can remember. What it never had was a way to tell people the wall was coming. FileMaker 26 closes that gap with Get ( AccountPasswordDaysRemaining ) — a function that returns how many days are left before an account’s password expires.

(Screenshot: the password expiration setting in Manage Security > Accounts)

It’s a small addition that makes you appreciate the platform a little more.

Is password rotation still worth doing?

Worth pausing on this, because it’s genuinely a mixed bag. Security folks have soured on forced rotation over the last several years, mostly because of how people actually respond to it. Force someone to change their password every 90 days and you don’t get a stronger password — you get Summer2025! turning into Summer2026!, or Fluffy1 turning into Fluffy2. The core password never really changes, just the number or year tacked onto the end, which does approximately nothing against credential stuffing or a password that’s already floating around from some other breach.

That said, plenty of you reading this don’t get to make that call. HIPAA, SOC 2, and PCI-DSS audits still expect to see documented rotation policies, and if your solution touches healthcare data, financial records, or anything else with a compliance officer attached, the policy isn’t going anywhere. Rotation also isn’t your only layer — pair it with MFA, encrypted data at rest, and privilege sets that actually limit what each account can touch, rather than treating it as your one line of defense.

So the honest take: if you’re required to expire passwords, this function is the tool that finally lets you do it without the ambush.

What the function actually does

Get ( AccountPasswordDaysRemaining ) returns the number of days left before the currently logged-in account’s password expires. When expiration isn’t enabled, or there’s simply nothing counting down for that account, don’t assume you’ll always get a normal positive number back — test for that case in your logic rather than building on the assumption that it always returns a straightforward day count.

A basic warning banner might look like this in a script triggered on file open:

If [ Get ( AccountPasswordDaysRemaining ) ≥ 0 and Get ( AccountPasswordDaysRemaining ) ≤ 7 ]

    Show Custom Dialog [ “Password Expiring Soon” ;

    “Your password expires in ” & Get ( AccountPasswordDaysRemaining ) & ” day(s). Update it soon to avoid getting locked out.” ]

End If

Nothing fancy — just enough to give users a chance to act before they’re forced to.

Where this is actually useful

The obvious use is a banner on the home layout, but it’s worth thinking a layer deeper than that:

  • OnFirstWindowOpen script trigger — check the days remaining once per session and surface a dialog only when it’s actually getting close, rather than nagging every single login.
  • Admin dashboard — loop through accounts (where permissions allow) and log expiration windows into a table so an admin can see account health across the whole user base at a glance, instead of finding out when someone can’t log in.
  • Escalating reminders — pair the function with a scheduled server script and your email notification system to step up the urgency as the deadline gets closer: a friendly heads-up at 7 days, a firmer one at 2.

None of this is complicated. That’s kind of the point — it’s a one-line calculation that lets you build a much better experience around a policy your users were already stuck with.

Small function, real usability win

This isn’t a flashy release-note item, but it’s the kind of change that quietly removes friction developers have been working around for years. If you’re already writing custom login screens or locked-out messaging in your solutions, this is worth wiring in — your users will notice the difference the next time they don’t get locked out mid-task.