Starting with Oracle 11g, if you get the following error when changing your own password, it means that you have to include REPLACE clause in your ALTER USER command:
ALTER USER testuser IDENTIFIED BY testpassword; Oracle: “ORA-28221: REPLACE not specified”
Syntax with REPLACE clause:
ALTER USER testuser IDENTIFIED BY testpassword REPLACE oldpassword; User altered.
If your password contains special characters, you may need to put it in quotations:
ALTER USER testuser IDENTIFIED BY "testp@ssw@rd" REPLACE oldpassword; User altered.
As per Oracle documentation,
You can omit the REPLACE clause if you are setting your own password or you have the ALTER USER system privilege and you are changing another user’s password. However, unless you have the ALTER USER system privilege, you must always specify the REPLACE clause if a password complexity verification function has been enabled, either by running the UTLPWDMG.SQL script or by specifying such a function in the PASSWORD_VERIFY_FUNCTION parameter of a profile that has been assigned to the user.