NHS Pay

ESR Locked Account or Forgotten Password: What to Do

FP FrontlinePay Editorial
Updated October 2026

Independent guidance — not affiliated with NHS England or DHSC

Short answer

NHSBSA's guide says that on the internet route you get 5 attempts at your ESR password before the account locks. To release it, use the Forgotten, Request Username/Password, Unlock Account link on the ESR login page and follow the time-limited email. That only works if you can still open the email account held on your ESR record. If you cannot, or it fails, your own employer's ESR team, system administrator or HR team is the only party that can reset the account. NHSBSA, NHS Pensions and FrontlinePay cannot.

This is the short, problem-first version for NHS staff in England and Wales who are locked out right now. For the full picture of how sign-in works, including smartcards and the ESR app, read ESR login help. FrontlinePay is independent and cannot see or change anything in ESR.

Find your situation

What has happenedWhat to do
I forgot my password, and I can still open the email on my ESR recordUse the Forgotten, Request Username/Password, Unlock Account link, then the email. See below.
I typed it wrong several times and I am lockedSame link. NHSBSA says it covers locked accounts as well as forgotten passwords.
The email on my ESR record is old or I cannot open itContact your local ESR team or helpdesk. NHSBSA says they must reset it for you.
I forgot my usernameThe same link emails you a username reminder. See below.
My smartcard is lockedThat is a smartcard issue, not an ESR password issue. See smartcard problems.
I have never had a loginAsk your ESR team or HR. They create access.
I have left the NHS and my work email is closedSee our P60 and P45 guide, which covers the leavers dashboard.
  • ✓ Go to the ESR Hub at my.esr.nhs.uk and choose Login to ESR. Type the address or use your own bookmark, not an emailed link.
  • ✓ Select Forgotten, Request Username/Password, Unlock Account.
  • ✓ Enter the email address on your ESR record and your date of birth. Those two are the minimum NHSBSA lists. The username is optional, and only useful if you have accounts with more than one organisation.
  • ✓ Open the email NHSBSA says ESR sends. It contains your username and a reset link, and states a time limit.
  • ✓ Set a new password that meets the on-screen rules. The ESR Hub states at least 12 characters, not one of your previous 4 passwords, and not a commonly used password. Then sign in.

ℹTiming

If the time limit in the email has expired, NHSBSA says you need to repeat the process. Use the most recent email, because an older link may no longer work.

The self-service route can fail for ordinary reasons: the email address on record is wrong, the email lands somewhere you do not check, or the details you typed do not match the record (check the date of birth). In each case the answer is the same: ask the people who control your account.

The ESR Hub's Looking for help page says:

  • • Contact the system administrator at your organisation.
  • • If you cannot find them, a search tool at esrsupport.co.uk lists the contacts organisations have chosen to publish.
  • • If nothing is listed there, contact your HR team.

It does not publish a phone number or email for staff. Your trust intranet, a poster by the staff room or your line manager is often the quickest way to the right person.

Forgotten username

You do not need to know your username to start. NHSBSA's guide says entering at least your email address and date of birth on the unlock page generates an email reminder containing your ESR username and a reset link.

What to tell the ESR team

  • • Your full name, employee or assignment number and the organisation you work for.
  • • Whether you use a smartcard or a username and password.
  • • What the screen says, word for word, and roughly how many attempts you made.
  • • Which email address you think is held on your ESR record, and whether you can still open it.
  • • Whether you need urgent access, for example for a payslip you need for a mortgage or tenancy.

Never send your password to anyone, including by email.

While you wait: your payslip

If you need your payslip and ESR is simply unreachable, your payroll team can often tell you the options. NHSBSA also describes a route for downloading your latest payslip when ESR is offline for maintenance but the Hub is up, though it requires your ESR login and does not allow password resets. See how to see your payslip on ESR. If the problem is wrong pay instead, see who to contact about wrong pay.

Want a heads-up when we add more NHS admin guides?

No spam, just the occasional useful addition to the site.

Free. Independent, not affiliated with the NHS. Every email has an unsubscribe link. See our privacy policy.

Sources and date checked

Checked 19 October 2026.

Related guides

ESR Login Help for NHS Staff

Sign-in routes, smartcards, the app and maintenance windows.

ESR Employee Self-Service: What You Can Do

Once you are in, what the system is for.

How to See Your Payslip on ESR

Including the route when ESR is offline.

My NHS Pension Password Rules and Login Help

A separate system with its own rules.

Frequently asked questions

How long does an ESR account stay locked? +
NHSBSA's published guidance does not give an automatic unlock time. It says that after the allowed number of wrong attempts the account is locked and that you release it through the Forgotten, Request Username/Password, Unlock Account link on the login page, or by asking your local ESR team. Do not assume it will unlock by itself. Some employers may configure their own rules, so ask yours.
The reset email never arrived. What now? +
Check your junk folder and that you typed the email address held on your ESR record. The reset only works if the address you enter matches the one in ESR. If it is an old address, or an account you can no longer open, the email goes nowhere useful. In that case your local ESR team or helpdesk has to reset the password for you, as NHSBSA's reset guide states.
I clicked the reset link but it says it has expired. +
NHSBSA's guide says the email states a time limit for resetting, and that if it has expired you need to repeat the process. Go back to the login page, use the Forgotten link again and follow the newest email only, because earlier links may no longer work.
I have two NHS jobs. Why did I get two emails? +
NHSBSA says that if you have ESR accounts with more than one organisation and do not enter a username on the reset page, you receive one email per account, each containing one username. Enter the username for the account you want if you know it, and use the matching email.
Can I reset my ESR password by phoning NHS Pensions or NHSBSA? +
No. The ESR Hub's help page directs staff with access problems to the system administrator at their own organisation. NHS Pensions deals with your pension record, not ESR access. See our NHS Pensions contact guide for what they can help with.
I lost the phone I used for ESR multi-factor authentication. +
The ESR Hub describes multi-factor authentication as optional and does not explain recovery if you lose the device on its overview page. Use the step-by-step user guide linked from that page, and contact your ESR team or system administrator, who are the people who can advise on your account. We do not describe a recovery procedure we could not verify.
Is it safe to ask a colleague to reset it for me? +
Only the ESR team or administrator at your employer should do it. Do not share your password or reset link with colleagues, and be wary of anyone who offers to fix ESR access in return for your details.

General information based on NHS Business Services Authority material at the date shown. Not affiliated with NHSBSA, ESR or any NHS employer. Only your employer's ESR team can change access to your account.

Free download: 2026/27 Agenda for Change pay scales

One page, every band, annual and hourly. We'll also email you when a pay award, back pay date or pay-scale change is confirmed.

Free. Independent, not affiliated with the NHS. Every email has an unsubscribe link. See our privacy policy.