This page covers changing an AliasFleet account password from Settings and resetting a forgotten password from the sign-in page. It sets out the steps for both routes, the password rule, how to confirm the change worked, and what to do when a reset email does not arrive or other sessions stay signed in.
The Settings route requires sign-in and the current password. The reset route requires access to the inbox of the email address used at sign-up, because the reset link is sent to that address. A password change is not the route for removing two-factor authentication; that is a separate setting, described in the two-factor authentication guide.
How do I change a password from Settings?#
Use this route when sign-in is still possible and the current password is known.
- Open Settings. Go to Settings → Security.
- Open the dialog. Click Change Password. The Change Password dialog opens.
- Enter the current password. Type the current account password in the first field.
- Enter the new password twice. Type the new password in the new password field and again in the confirmation field.
- Confirm the change. Submit the dialog. The new password takes effect immediately.
How do I reset a forgotten password?#
Use this route when sign-in is not possible because the password has been forgotten.
- Open the reset page. Go to the Forgot Password page from the sign-in page.
- Enter the account email. Type the email address used at sign-up, then submit the form.
- Open the reset email. A reset link is sent to that address. Open the newest reset email.
- Follow the link. Click the reset link in the email. It opens a page for setting a new password.
- Set the new password. Enter a new password and submit the form.
Reset links expire after a short window. When a link has expired, request a new link from the Forgot Password page and use the newest email, since an older link no longer works.
What are the password rules?#
Passwords must be at least 8 characters. The stated minimum is 8 characters. A passphrase of several random words is recommended: several random words are easier to remember than a short string of symbols and harder to guess. A password used for AliasFleet should not be reused from another service, because a leak at that service would then expose the AliasFleet account as well.
How do I check that the new password works?#
Sign out of the account, then sign in again with the new password. Where two-factor authentication is enabled, sign-in still asks for the authenticator code after the password, as described in the two-factor authentication guide. A successful sign-in confirms that the new password is active. When sign-in fails, check for a typing error first, then repeat the reset route rather than retrying the same password repeatedly.
What happens to other sessions after a password change?#
A password change does not sign out other devices automatically. Active sessions on other devices stay signed in until they are revoked. This matters most when the password was changed because of suspected unauthorised access. In that case, open the Active Sessions page after changing the password and revoke any unfamiliar session, or use the option to revoke all other sessions. Revoking a session signs that device out, and it cannot sign back in with the old password.
What if the reset email does not arrive?#
Work through the causes in order before requesting another link.
| Problem | Action |
|---|---|
| Email in spam or another folder | Check the spam folder and any filtered folders in the inbox. |
| Wrong address entered | Confirm that the address entered matches the address used at sign-up. A reset link sent to a different address cannot reach the account. |
| Email delayed | Wait a few minutes, then check again. Mail delivery is not always instant. |
| Link expired | Request a new link from the Forgot Password page and use the newest email. |
| Still no email | Contact support, and state which address was entered so the account can be checked. |
How does a password change interact with two-factor authentication?#
A password change does not remove the second sign-in step. After the change, sign-in still requires the password and then the authenticator code, where two-factor authentication is enabled. The documented route for removing the second sign-in step is the Disable 2FA option in Settings, described in the two-factor authentication guide; a password change is not that step. Recovery codes saved at setup remain the documented backup route when the authenticator app is lost. When two-factor authentication is enabled and both the authenticator app and the recovery codes are unavailable, the reset route on its own does not restore access; support is the remaining route, as described in the two-factor authentication guide and the cannot log in guide.
What should I do after a suspected breach?#
Change the password from Settings, revoke unfamiliar sessions from the Active Sessions page, and review the security tips guide for the remaining account checks. When sign-in is not possible at all, use the reset route first, then revoke sessions once signed in. The blog post on whether changing a password stops hackers explains why sessions, tokens, and recovery routes also need attention after a password has been exposed. When sign-in problems continue after a reset, the cannot log in guide covers the next checks.