ORA-01017: invalid username/password; logon denied is Oracle's authentication failure. Like other databases, Oracle does not say which half failed, and the same message covers a genuinely wrong password, a username that does not exist in this database, and subtler mismatches: a password whose case handling differs between the client era and the server's settings, or credentials that are correct for a different database than the one the connection actually reached. Systematic elimination, not repeated guessing, is the way through it, not least because repeated failures can lock the account (which then reports a different error, ORA-28000).
SELECT username, account_status FROM dba_users WHERE username = 'APP_USER';.SEC_CASE_SENSITIVE_LOGON governs it on older releases.@, /, or quotes break naive connect-string parsing and present as wrong credentials; setting the password through a proper tool or escaping per the client's rules separates this from a truly wrong password.How is this different from ORA-28000 (account locked)? 28000 is explicit: the account exists and is locked, typically after too many failed attempts (profile FAILED_LOGIN_ATTEMPTS) or by an administrator. 01017 is the generic rejection before that threshold. If repeated testing turns 01017 into 28000, stop guessing; the account now needs an unlock (ALTER USER ... ACCOUNT UNLOCK) as well as the right password.
The password is definitely right; it works in another tool, why? Then the failing client is sending something different: a stored old password in its configuration, the connect string landing on a different database, or special characters being parsed. Compare by testing the exact client configuration, not the password in the abstract.
Can an expired password produce 01017? Expiry is normally reported distinctly (ORA-28001, with a grace-period warning flow in proper clients). Some thin or embedded clients collapse several logon failures into 01017-like reporting, which is another reason to verify in SQL*Plus or SQLcl.