Username and password locked — how to reset

You typed the password the way you always type it — caps lock off, a hint on a sticky note that fell behind the weighing scale. Invalid. You try the older password from 2022. Invalid. Third try. Locked. The bulb above the billing desk flickers. GSTR-1 is still a draft. You wanted to finish before the morning load arrives.

The username itself might be wrong. Some shops log in with GSTIN by habit. GSTN user ID is often not the GSTIN. It is a separate username created at first login. If you mix them, the portal can lock the real user while you stare at a different error.

Your nephew says use Forgot Password. He clicks it on a phone browser, enters a Gmail that belongs to the previous accountant, and waits for a mail that will never come. You now have a locked user and a reset sitting in an inbox nobody opens. The night is about User Services and one registered mobile.

Why the counter is stuck

A locked GST user means you cannot file, cannot pay, cannot reply to a notice. For a small trader the lock usually happens in a cluster: due dates, or the day the helper who “knew the password” left.

Failed tries are not infinite. GSTN protects the account. After several wrong passwords the user locks for a period. Waiting ten seconds and hammering the same wrong password again is how a two-minute mistake becomes an overnight problem.

Forgot username is a different stuck. You remember the password in the cash book, but not the user ID. Without the user ID, login never starts. People then create a fresh user, get a second username, and live with two identities. Later OTP follows the user you are not using.

Reset is official and slow if the registered email is dead. Start with the recovery screens, not with a new registration.

Menu path on gst.gov.in

Open gst.gov.in yourself. On the home page find Login. Under or beside the login box you should see Forgot Username and Forgot Password. Those two links are the legal reset path. They are not a CA’s private tool.

Forgot Username typically asks for GSTIN and then sends the username to registered email or registered mobile after OTP. Have the GSTIN certificate or a filed return handy so you type the fifteen characters correctly. Zero and the letter O get mixed at night.

Forgot Password asks for the username plus GSTIN in many flows, then OTP on registered mobile or email, then a new password that meets the portal’s rules. Read the live page. GSTN changes password rules after security updates. Check this month’s official screen; do not copy an old blog if the page says something else.

After you are inside, Services → User Services is where account tools live, including user management. Do not confuse this with Services → Registration, which is for GSTIN amendments.

Returns Dashboard remains Services → Returns → Returns Dashboard. You only need it after the lock is cleared. Do not file from a friend’s GSTIN to “just pay something tonight.”

Steps you can still do after closing

Write the GSTIN on paper. Write every username you have ever used, including the one on an old screenshot. Try Forgot Username first if you are unsure. One successful username SMS or email saves you from locking a second identity.

Use the registered mobile for OTP. If you are holding the shop phone and GSTN still sends to a personal number in another town, the reset will not reach you. In that case the password screen is not your real problem — contact details are. Get local help rather than guessing OTPs.

When the new password form appears, choose something you can type without a sticky note on the monitor. Mix letters and numbers as the page demands. Confirm it once. Log in immediately on the same device. If login succeeds, open Returns Dashboard and see the period status before you celebrate. A lock can hide an unfiled month.

If the portal says the user is locked for a cooling period, stop typing passwords. Wait as instructed on the screen. Use that wait to find the registered email. Search the mailbox for GSTN, GST portal, username. Check spam.

If Forgot Password itself fails because OTP never arrives, treat it as the wrong-mobile problem: session timeout, SMS delay, dead SIM. Reset cannot finish without that OTP.

Keep one notebook line: date, time, whether username recovery worked, whether password reset worked, exact error.

After a successful reset, file only what you meant to file. Do not rush GSTR-3B with last month’s copy because you are angry at the lock.

Habits that lock you again

Caps lock and the Hindi keyboard layout. You think you typed English “Shop@” and the machine typed something else. Look at the password dots and the keyboard indicator.

Sharing one user ID with three people who each change the password “so it is safe.” Nobody writes the new one. Next due date, lock.

Saving the password on a shared computer, then the next person tries login. Change the password from a trusted device if that happened.

Using Forgot Password five times in ten minutes with different emails. You may trigger more locks or more OTPs. One clean attempt with the correct GSTIN and registered channel is better.

Creating a new user every time you forget. You will not remember which user filed GSTR-1. Notices still go to the GSTIN, but login chaos remains yours.

When a local helper is safer

If registered email and mobile are both dead — old accountant, surrendered SIM, unused mailbox — self-service reset will not complete. You need the official contact-update path, which often needs the old OTP or a deeper GSTN process. That is local help territory.

If the screen says the username does not exist, or GSTIN and username do not match, stop inventing spellings after three tries. A practitioner can check how the first user was created.

If you suspect someone else changed the password, do not keep fighting the lock. Reset through Forgot Password using registered OTP, then review users under User Services. If you cannot get OTP, you cannot prove control tonight.

If a notice deadline is close and you are still locked after Forgot Username and one Forgot Password cycle, call the person who already files for you. Give GSTIN and error text, not the new password over a voice note.

Do not pay a stranger who says they have a “backend unlock tool.” Only gst.gov.in reset plus GSTN processes are real.

FAQ

Is my username the same as my GSTIN?

Often no. GSTIN is the fifteen-character registration number. Username is a login ID created for the portal user. Some people set a username that looks like the GSTIN, which adds confusion. If login fails, run Forgot Username with the GSTIN and read what GSTN sends to registered email or mobile. Use that exact username in the login box.

How many wrong passwords does it take to lock the user?

GSTN does not print a shop-friendly countdown on every screen. Treat several failures as a lock risk. After two or three wrong tries, stop and use Forgot Password. If the page says locked, wait for the period it shows.

What if Forgot Password OTP goes to the old accountant’s mail?

Then you do not control the registered email. You cannot complete a safe reset from the shop phone. You need that mailbox, or an e-contact change through the proper User Services path after you regain access, or local help if you cannot regain access. Do not ask the accountant to forward OTP in a group chat if you no longer work with them — finish a clean handover instead.

Can I file from another GSTIN while this user is locked?

No. Each GSTIN has its own returns. Filing on a relative’s portal does not pay your tax or discharge your return. It creates a wrong filing on their account. Wait for reset or get help on your GSTIN. Check this month’s official due date on the portal so you know how many hours you actually have.

GST Atka is not a GSTN office. File on gst.gov.in. Rules change. Do not evade tax. Personal case: get local help.