Passwords and recovery

Password problems are best solved before they happen, so let’s go through the recovery flow once and mention a few gotchas.

The password rules

At sign-up and at reset, passwords must:

• Be at least 8 characters.
• Include at least one uppercase letter.
• Include at least one lowercase letter.
• Include at least one number.
• Include at least one special character (punctuation).

We recommend a password manager. Any random 16-character password will satisfy the rules and be easier to remember by not remembering it.

Forgot password

1. Go to Forgot password.
2. Enter the email on your account.
3. Submit. You’ll see a confirmation toast.
4. Check your email. The reset link expires after a short period — use it promptly.
5. Click the link — you’ll land on the reset page.
6. Enter a new password and confirm it.
7. Submit. You’re signed in automatically if your email was included in the link; otherwise, sign in normally.

Didn’t get the email?

• Check spam.
• Confirm the email matches the one you registered with. Typos here are the most common cause.
• Wait a minute and retry — occasionally upstream mail providers delay.
• If you signed up with Google/Apple, you may not have a password yet. Use the reset flow anyway to set one.

Reset link expired

Just start the flow again. Old links are single-use — once you’ve used (or expired) one, request a new one.

Changing your password when signed in

Currently, change-password while signed in uses the same reset flow:

1. Sign out.
2. Use Forgot password on the sign-in page.
3. Set a new password via the reset link.
4. Sign in with the new password.

Suspicious activity

If you suspect someone else has signed in with your credentials:

1. Reset the password immediately.
2. Review the All Sites list and the Submissions for anything unexpected.
3. Check Billing for unrecognised charges.
4. Contact support with a summary.

Next

• Sign-in methods
• Your profile
• Deleting your account