Password and recovery
Forgot your password, the reset email never arrived, still cannot sign in after resetting, and password policy questions.
I forgot my password
On the sign-in page, tap "Forgot password" and enter the email used at registration. A reset link is sent by email; the link is single-use and time-limited — once used, it is dead.
The reset email never arrived
Check in this order:
- Is the address correct (including case and any trailing space);
- Spam folder and the "promotions" tab;
- Did you request several times in a row — repeated requests hit the rate limit, and the earliest email may already be invalidated by later ones;
- Is that address actually the sign-in email for this account (an account can hold several addresses, but only the primary one receives reset mail).
The reset link says it has expired
Three causes, most likely first:
| Cause | Notes |
|---|---|
| Already used | Reset links are single-use; the second click always fails |
| Timed out | Links expire; start a new request |
| Invalidated by a newer request | A new request invalidates older links; only the newest email works |
Still cannot sign in after resetting
- With two-step verification enabled, resetting the password does not reset the verification methods: the passkey or authenticator step is still required;
- If every verification method is lost (new phone, deleted authenticator, recovery codes used up), you need the account recovery flow rather than another password reset.
Password requirements
There are hard minimums on length and character set; weak passwords are rejected outright rather than "warned but allowed". When rejected, the error response names the constraint that failed — see Error codes.
Related
- Managing verification methods: Verification methods
- Order to follow if someone else used your account: Account and security
Account and security
Questions about the account's own state — passwords and recovery, verification methods, sessions, and the order to follow when someone else has used your account.
Verification methods
What passwords, passkeys, authenticators, recovery codes and email each do, why keeping two methods matters, and how recovery codes are consumed.