Many Coretax DJP users experience the same frustration: they successfully log in, begin a tax process, and then suddenly the system stops—requesting a passphrase. Assuming it is the same as their login password, they repeatedly enter the wrong credentials until the process fails entirely.
In Coretax DJP, passwords and passphrases serve fundamentally different purposes, even though both relate to account security. This distinction is often overlooked, which is why tax processes can fail even after a successful login.
To use Coretax correctly, passwords and passphrases must be understood as two separate layers of security, each with a distinct role. This layered approach is designed to protect taxpayers and ensure accountability in digital tax administration.
Below is a clear explanation of how they differ—and why the distinction matters.
1. Difference in Function and Definition
Are Coretax passphrases and passwords the same?
No. They are not.
A Coretax password functions as the initial access key to your account. Without the correct password, a user cannot log in to the Coretax DJP system at all. It is used every time a user accesses the system and is personal to the registered account.
Because it acts as the entry point, the password must be kept confidential to prevent unauthorized access.
A Coretax passphrase, on the other hand, is an additional authorization key used to approve specific tax actions. It is not used for login. Instead, it is required to validate actions that are considered important, final, and legally consequential.
In practice, the passphrase functions like a digital signature. Every use of a passphrase is recorded in the system’s audit trail, which is why it carries a higher level of sensitivity than a login password.
2. Difference in Purpose
The password is used to authenticate the user’s identity when accessing Coretax. Its role ends once the user has successfully entered the system.
The Coretax passphrase is used to authorize specific actions—such as finalizing documents or approving tax submissions. It represents explicit consent for a tax-related action, not merely access to the platform.
In short:
- Password: login and account access
- Passphrase: approval and authorization of tax actions
3. Difference in Position Within the Coretax Workflow
The password always appears at the beginning of the process—during login. After logging in, users can prepare data, draft documents, and navigate menus without being asked for a passphrase.
A passphrase is only requested at specific stages, typically when:
- A document is about to be finalized
- A tax transaction is being submitted
- The system requires additional validation
This confirms that the passphrase is not part of routine technical steps, but a marker that an action carries administrative and legal consequences.
4. Difference in Sensitivity and Risk Level
If a password is compromised, the primary risk is unauthorized access. While serious, the impact can usually be controlled by changing the password or locking the account.
If a passphrase is compromised, the risk is far greater. A passphrase can be used to authorize tax documents or transactions, and the system will still record them as officially approved by the taxpayer. The implications are clear:
- Password leak: access risk
- Passphrase leak: risk of tax transaction misuse
This is why the passphrase is treated as a higher-sensitivity credential.
5. Difference in Frequency of Use
Passwords are used frequently—often daily—making them easier for users to remember. They are commonly managed by operational staff who handle Coretax activities on a regular basis.
Passphrases are used far less often, only during specific processes. Because of this, many users encounter issues such as forgetting their Coretax passphrase, especially during critical periods like tax reporting deadlines.
6. Difference in Roles for Corporate Taxpayers
For corporate taxpayers, the distinction between passwords and passphrases is not merely technical—it is a deliberate internal control mechanism built into the Coretax system. This separation supports sound governance by ensuring that access to the system is clearly differentiated from the authority to approve legally binding tax actions.
In practice, roles are typically divided as follows:
Passwords are usually held by:
- Tax staff
- Finance administrators
- Technical operators
Passphrases should be held by:
- Responsible tax officers
- Finance managers
- Directors or other authorized executives
This role separation ensures that not everyone who can log in to Coretax can automatically approve or finalize tax actions. The passphrase functions as an additional safeguard, reinforcing accountability and reducing the risk of unauthorized or accidental approvals within the organization.
7. Difference in Audit and Accountability
One of the most critical distinctions between passwords and passphrases in Coretax lies in auditability and legal accountability. Coretax is designed not only to process tax data, but also to clearly record who is responsible for each action taken within the system.
From an audit perspective:
- A password log only shows who accessed the system
- A passphrase log shows who explicitly approved a specific tax action
Every use of a passphrase is recorded as part of the system’s audit trail, including who approved the action, when it was approved, and what was approved. This makes the passphrase a formal marker of responsibility, not just a technical security step.
Because of this, passphrases carry a much higher level of accountability than login passwords and play a key role in audits, dispute resolution, and regulatory reviews.
8. Difference in Impact When Used Incorrectly
The consequences of mistakes in Coretax credentials vary significantly depending on whether the issue involves a password or a passphrase. While both relate to system security, their misuse carries very different operational and compliance risks.
Entering the wrong password typically results in a failed login, with no lasting impact. Incorrect use of a passphrase, however, can have broader implications and may:
- Stop tax processes entirely
- Prevent documents from being finalized
- Delay statutory reporting
- Increase the administrative burden on tax teams
This is why understanding the difference between passwords and passphrases is not merely a technical concern—it is a core element of tax risk management and operational continuity.
| Key Takeaway: Simply put the core difference between password and passphrase is: Passwords answer “Who are you?”Passphrases answer “Do you approve this action?” |
When these roles are clearly understood and not treated as interchangeable, Coretax usage becomes more secure, structured, and aligned with the purpose of Indonesia’s digital tax system.
Password vs Passphrase in Coretax DJP Overview
| Aspect | Coretax Password | Coretax Passphrase |
| Primary function | Account access / login | Action authorization |
| When used | Every login | Specific processes only |
| Sensitivity level | High | Very high |
| Impact if incorrect | Login failure | Tax process blocked |
| Impact if compromised | Unauthorized access | Risk of transaction misuse |
Should Password and Passphrase Be the Same?
In practice, passwords and passphrases should never be the same. They serve different purposes and carry different risks.
Using the same credentials increases security exposure. If one credential is compromised, it can affect processes that are meant to be protected by an additional security layer.
Risks of Misunderstanding Passwords and Passphrases
The most common mistake is assuming the passphrase is the same as the login password. This leads to repeated errors and failed tax processes.
Another risk arises when only one person knows the passphrase. If that person is unavailable, tax processes can be delayed—one of the most common causes of “forgotten Coretax passphrase” cases in companies.
Without clear internal procedures, these issues can lead to administrative delays and compliance risks.
Best Practices for Managing Coretax Passwords and Passphrases
Effective management starts with understanding each credential’s role:
- Passwords are managed at the user-access level
- Passphrases should be governed through authorization and approval controls
Companies are strongly advised to establish clear internal SOPs covering:
- Role separation
- Approval mechanisms
- User education
For technical steps such as passphrase changes, always refer to official DJP guidance on how to change a Coretax passphrase.
Managing Digital Tax Security and Payroll in an Integrated Way
Understanding the difference between passphrases and passwords is not just about system usage—it is central to compliance, internal control, and digital tax security.
In practice, tax challenges are closely linked to HR and payroll data. When employee data, organizational roles, and tax authority structures are not managed in an integrated way, the risk of delays, errors, and authorization issues increases.
With SunFish HR Payroll Enterprise, companies can manage payroll and employee administration centrally, supporting more structured, documented, and compliant tax processes. Consistent data management helps ensure that tax-related information is accurate and defensible.
If you would like to explore how this can be tailored to your organization, the DataOn professional team is available to provide guidance and support.
FAQ: Passphrase vs Password in Coretax
Q: Is a passphrase the same as a password?
A: No. A password is used to log in, while a passphrase is used to authorize specific tax actions.
Q: What does a Coretax passphrase mean?
A: A passphrase is a digital approval key used to validate important tax processes.
Q: What credentials are used in Coretax?
A: Coretax uses both passwords and passphrases, each with different purposes.
Q: Can a Coretax passphrase be changed?
A: Yes. Passphrases can be updated through official DJP procedures.
