Unable to Log in to a Salesforce Sandbox Troubleshooting

This article covers common reasons why a Salesforce sandbox login fails and how to resolve them. Causes include stale browser credentials, My Domain login policy restrictions, incorrect login URLs, and frozen user accounts.

If you receive an "Incorrect username and password" error when logging in to a Salesforce sandbox environment, verify that you are using the correct password for your instance (cs1, cs2, etc.). Note that usernames and passwords can differ after a sandbox is refreshed. Review Create a Sandbox for more information.

For username conventions in a sandbox, see the Users and Contacts section the Salesforce Help under Sandboxes: Staging Environments for Customizing and Testing Help page.

If you are using the correct username and password for your sandbox instance, the following issues may be preventing you from logging in.

Login Troubleshooting Steps

Old Login Information Is Saved

If your web browser has saved login information from before the last sandbox refresh, login attempts will likely fail. Clear the browser's cache, cookies, and saved passwords, then restart the browser to remove all old credentials.

Note: Once a sandbox is created or refreshed, you can log in using the production password.

Utilizing https://test.salesforce.com After a Sandbox Is Created or Refreshed

After a sandbox is created or refreshed, it can take 24–48 hours before you are able to log in using https://test.salesforce.com. During this period, access the sandbox using its My Domain login URL instead.

The Login URL Is Incorrect

In some cases, the generic sandbox login URL (https://test.salesforce.com) must specify the instance where the sandbox resides.
To find your instance in the 'Location' column:

In Salesforce Classic: Setup | Deploy | Sandboxes
In Lightning Experience: Gear icon | Setup | Platform Tools | Environments | Sandboxes

If login issues continue, update the sandbox login URL from <REDACTED> to <REDACTED> where csX represents your sandbox instance (for example, cs1, cs2, or cs3).

My Domain Settings

If the sandbox org has My Domain enabled and the Login Policy is set to "Prevent login from <REDACTED> users must log in using the My Domain URL, such as https://[MyDomain]--[SandboxName].csx.my.salesforce.com.
A system administrator can disable this restriction:

Go to My Domain Settings from Setup.
1. In Salesforce Classic: Setup | Administer | Domain Management | My Domain
2. In Lightning Experience: Setup | Settings | Company Settings | My Domain
Scroll down to My Domain Settings.
Click Edit.
Deselect **Prevent login from <REDACTED>
Click Save.

User Maintenance

With selective access, a Salesforce admin grants access to specific users through a public group. Email addresses for users in the group remain in their original format and do not need to be modified. Users who are not part of the public group must be unfrozen in the sandbox in order to access it.
Any user who is part of the Public Group and has not logged in to an existing or newly created, cloned, or refreshed Developer or Developer Pro sandbox within the first 60 days is frozen.

The system administrator can unfreeze the user so they can log in with an existing password, or reset the password if required.

For more information on user maintenance, see:

Select Who Has Access To a Sandbox (Salesforce Help)
Determine Who Has Sandbox Access (Salesforce Help)
Increase Sandbox Security with Inactive User Freezing (Salesforce Help)

Additional Information About Logins and Resetting the Sandbox Password

Sandbox email addresses are appended with '.invalid' at the end. When resetting a password, ensure the email address is updated first. Work with your system administrator to update the email address. For more information, see Email addresses in sandbox appended with '.invalid' after refresh (Salesforce Help).

Note: For sandbox users who did not update their email addresses to a valid domain prior to the refresh, you may still see the '@example' domain followed by '.invalid' at the end.

A newly refreshed sandbox shares the same password and password expiration date from its production organization. Once the password expires, it affects both environments. If the production password is changed, that change does not automatically apply in the sandbox — users attempting to log in to the sandbox with the new production password will encounter a login error.

Although most email addresses are appended with '.invalid,' this does not apply to the admin user who created or submitted the sandbox for refresh. If an admin cannot access the target sandbox, check whether other admin users can assist with updating the user record's email address and resetting the password. If no admins can log in to the sandbox, contact Support and follow the Change an administrator's email address in sandbox (Salesforce Help) process.