Change or reset your password

Change your password in Settings

1. Open Settings → Security

   In the Password card, click Change password.

2. Enter your current password and the new one twice

   8 to 72 characters, different from the current one. The meter under the field shows how strong it is.

3. Click “Change password”

   This device stays signed in. Every other session is signed out, and the confirmation tells you how many.

With two-factor authentication on, your current password is enough: you already entered a code when you signed in. A wrong current password counts as a failed sign-in, so after 5 wrong tries in 15 minutes the account is locked for 15 minutes.

Reset your password

1. Click “Forgot password?” on the sign-in page

   Enter the email address of your account and click Send reset link.

2. Open the link in the email

   The link works once and expires after 60 minutes. For your privacy, the page says the same thing whether or not an account exists for that address.

3. Choose a new password

   8 to 72 characters. Click Update password, then sign in with the new password.

What a reset changes

• Every other session is signed out, on every device.
• Your passkeys are removed, because a passkey signs in without the password. The security email lists them; add new ones in Settings → Security after you sign in.
• Other reset links you asked for stop working.
• A lockout after too many wrong passwords is lifted.
• Your email address counts as confirmed, because you opened the link from your inbox.
• You get a security email confirming the change.

Accounts that sign in with Google

If you have always used Sign in with Google, your account has no password. Click Set a password in Settings → Security, or use the reset flow above: both add one, so you can sign in either way from then on.

Setting a password in Settings needs a sign-in from the last 10 minutes. If yours is older, click Sign in with Google again and you come straight back to the form.

Security emails

We email you right away when something important changes on your account:

• your password is changed, set or reset;
• two-factor authentication is turned on or off, or new recovery codes are created;
• a passkey is added to or removed from your account;
• you sign out a session, or all other sessions at once (one email per action);
• someone signs in from a browser, system or network your account has not used in 90 days.

Each email says what happened, when (in UTC), which browser and system it was, and the network with the last part of the IP address hidden. These emails cannot be turned off.

No email arrived?

• Check the spam folder and that you typed the address you signed up with.
• An account can receive at most 3 reset links per hour, and the page accepts only a few requests per 10 minutes from one network. Wait a little and try again.
• Disabled accounts do not get reset links.