# Password Reset

Request a reset link by email if you've forgotten your password.

## Resetting a Forgotten Password

1. Go to [/forgot-password](/forgot-password)
2. Enter the email address associated with your account
3. Click "Send Reset Link"
4. Check your email for a message with a reset link
5. Click the link and enter your new password (minimum 8 characters)
6. You're logged in with the new password

The reset link expires after 15 minutes. If it expires, request a new one.

For security, the form always confirms that a link was sent regardless of whether the email exists. This prevents anyone from discovering which emails are registered.

## What Happens on Reset

- Your password is updated immediately
- All other active sessions are revoked (if someone else had access, they're logged out)
- If you had a breached password, the warning clears
- The reset link becomes invalid after use (single-use)
- If you change your password before using a reset link, the link becomes invalid

## Changing Your Current Password

If you know your current password and want to change it:

1. Go to Settings > Security
2. Click "Change Password"
3. Enter your current password and your new password
4. All other sessions are revoked automatically

## Password Requirements

- Minimum 8 characters, maximum 128
- No character type requirements (uppercase, numbers, symbols are not enforced)
- Passwords are checked against known breaches via HaveIBeenPwned (k-anonymity; your password is never sent externally). Breached passwords trigger an advisory warning but are not blocked.

## Account Lockout

After 5 consecutive failed login attempts, your account is locked for 15 minutes. A one-time login link is emailed to you automatically. Click the link to bypass the lockout and log in. Passkey login is not affected by password lockout.

For full details on 2FA, passkeys, and session management, see [Account Security](./security.md).

## See Also

- [Account Security](./security.md): 2FA, passkeys, and session management
- [Getting Started](./getting-started.md): Account creation