Reset your password

What it is

Password reset sends a one-time link to your email address. Following it lets you set a new password without knowing the old one.

One thing about the flow surprises people, so it is worth stating up front: the page always says a link is on its way, whether or not the address you typed has an Agentency account. That is intentional. If the message differed, anyone could type addresses into the form and learn which ones are registered here — a free list of targets. The identical response gives that away to nobody.

When you would use it

• You forgot your password.
• Sign-in tells you a password change is required.
• You think someone else may have your password.
• You are cleaning up after using Agentency on a shared computer.

Where to find it

Open /forgot-password, or select Forgot password on the sign-in page.

Steps

1. Open /login and select Forgot password, or go straight to /forgot-password.
2. Enter the email you sign in with. It has to be exactly the address on your account — a similar address will silently go nowhere.
3. Complete the captcha if one appears.
4. Submit. You get a success message regardless of whether the address exists.
5. Open that inbox and follow the reset link. Do it promptly — the link expires.
6. Choose a new password on /reset-password and confirm it.
7. Sign in on /login with the new password. If you have two-factor, you will still be asked for a code.

What you will see

/forgot-password is a short email form. After you submit, you stay on a success state; you are not redirected anywhere.

The reset page asks for the new password twice and shows a strength indicator as you type. After a completed reset, the sign-in page may show a confirmation that your password was updated.

Choosing the new password

• Longer beats complicated. A passphrase of several unrelated words is easier to remember and harder to crack than a short string with a symbol bolted on.
• Do not reuse it. If this password exists on another site, a breach there becomes a breach here.
• Use a password manager if you have one. Let it generate and remember the password so you never have to.
• Do not just increment the old one. Password2 after Password1 is not a reset, it is a formality.

Once you have reset, consider turning on two-factor authentication — if you are resetting because you suspect the password leaked, that is the change that actually protects you.

If you signed up with Google

Google-only accounts have no Agentency password, so there is nothing for this flow to reset. Requesting a link will produce the same reassuring success message and no usable email, because there is no password on the account to change.

Keep using Continue with Google. See Sign in with Google.

If you have forgotten your Google password, that is a Google problem — reset it there and then come back.

Limits and plan notes

• Reset links expire after about 30 minutes. Request a fresh one rather than hunting for an old email.
• A link is single-use. Once you have set a new password, that link is dead.
• Requests are rate-limited to a few per minute. Submitting repeatedly will not make the email arrive faster and can get you throttled.
• Resetting your password does not turn off two-factor. If two-factor is enabled you still need your authenticator or a backup code to finish signing in — see Backup codes.
• Resetting does not sign other devices out, because there is no device list. See Sessions and sign out.
• Reset works the same on every plan.

Common problems

The email never arrives.

In order: check spam; confirm you typed the exact address on your account; wait a minute and try once more. Remember that the success message proves nothing — if the address is wrong or unregistered, you get the same message and no email. If you are not certain which address you registered with, and you can still sign in somewhere, check Settings → Account.

The link says it has expired.

Links last about half an hour. Request a new one from /forgot-password and use it straight away.

I clicked the link twice and the second time failed.

Reset links are single-use. If the first attempt succeeded, sign in with the new password. If it did not, request a new link.

I reset my password and still cannot get in.

Two likely causes. Either two-factor is on and the form is waiting for a code, or you have hit the lockout after several failed attempts — wait about fifteen minutes and try once, carefully.

I do not have access to that mailbox any more.

This is the hard case, because the mailbox is the recovery route and Agentency has no self-service email change. See Change your name or email, and contact support if the account owns a paying workspace.

Sign-in says a password change is required.

Follow this flow. The requirement clears once the new password is set.