How about: "password authentication failed or account expired for user \"%s\""
It's a bit longer, but sounds more like a full sentence, no?
Yes but I don't think it is accurate, what about:
"Authentication failed or password has expired for user \"%s\""
I think we need to keep the first "password". "Password authentication" is a single thing, it is the authentication method attempted. It is the password method (which includes MD5) which failed, as opposed to the LDAP method or the Peer method or one of the other methods.
Without this level of explicitness, it might be hard to figure out which row in pg_hba.conf was the one that PostgreSQL glommed onto to use for authentication. (Although by this argument, I don't know why MD5 doesn't get its own message specific to it, rather than sharing plain password)