Changing your password

There are two ways to end up with a new password, and which one you want depends on whether you still know the current one.

If you know your current password

Sign in, open Security from the account menu, and use the Password card at the top. Enter your current password and the new one, and press Change password. The same checklist you saw when you registered ticks off each rule under the new-password field, and the button stays disabled until they are all met.

This is the quicker route whenever you have not actually forgotten anything — you just want to rotate it.

If you have forgotten your password

Without the current password there is nothing to type into that card, so the route is the emailed reset link instead. It takes about a minute.

Sign out first — the sign-in screen is not reachable while you are signed in — then press Forgot password? beneath the password field. Enter the address your account uses and press Send reset link.

The confirmation you get back is deliberately vague — it says a link has been sent if that address is registered. It reads the same way whether or not the address exists, so that nobody can use the form to find out who has an account here.

Open the email and press the button in it. That lands you on Set new password with your address and the link's code already filled in, so all you type is the new password. A checklist under the field ticks off each rule as you meet it, and the button stays disabled until they are all met — those are the rules actually enforced, not a guess at them.

Press Reset password and you are returned to the sign-in screen to sign in with the new one.

If the link does not work

Reset links expire, and once one has been used successfully it stops working. Either way the screen refuses it with a message saying so; press Request a new link and start again.

A password the rules reject is a different failure, and says so specifically — the link is still fine, so just choose a stronger password on the same screen.

If your email client mangles the link, Enter the code manually on the confirmation screen gives you a form to paste the address and the code from the end of the link into by hand.

If you never confirmed your address

Asking for a reset on an unconfirmed account sends you a confirmation link instead, because a password cannot be reset on an address that was never confirmed. Confirm from that email first, then ask for the reset. This is the way back in for an account that was registered but never activated.

If two-factor authentication is on

Changing your password from the Security page, or resetting it by email, both work exactly the same whether or not two-factor authentication is turned on — it is not asked for again during either route. Removing a factor or turning two-factor off is a separate action, on the same page, and that one does ask for your current password. See Two-factor authentication.