Passwords and account recovery
The password rules, how to reset a forgotten password, how to add a password to a Google-only account, and what the security e-mails mean.
Overview
One set of password rules applies everywhere: when you create an account, change your password, reset it, or add one. A password must:
- be 10 to 128 characters long;
- contain an upper-case letter, a lower-case letter and a number;
- not be an easy-to-guess word such as "password" or "qwerty";
- not contain the part of your e-mail address before the @.
The checklist under the password field ticks each rule as you type.
Steps
Reset a forgotten password
- On the sign-in page, select Forgot password? (or open
/forgot-password). - Enter your e-mail address and select Send reset link.
- Open the e-mail and select Choose a new password. The link works once and expires after 30 minutes. Asking for a new link makes the older links stop working.
- Enter a new password. It must be different from your current one.
- Sign in with the new password. A reset signs out every device, including the one you used, so you sign in again.
You always see the same message after step 2, whether or not an account exists for the address. This stops anyone from finding out who has an account.
Change your password while signed in
- Open Account → Account.
- Enter your current password and the new one, then save.
- This device stays signed in. Every other device is signed out.
Add a password to an account that signs in with Google
If you created your account with Google, it has no password yet.
- Open Account → Account and choose to add a password. We e-mail you a one-time link. Your session alone is not enough to add a password; this protects you if someone else gets hold of a signed-in device.
- Open the e-mail and select Add a password. The link works once and expires after 30 minutes.
- Choose a password. From then on you can sign in with Google or with your e-mail and password.
If you use Forgot password? on a Google-only account, the e-mail says that you sign in with Google. It also includes the same Add a password link.
Security e-mails we send
| When | |
|---|---|
| Your password was reset / changed / added | Right after the change. It shows the time (ET), the IP address and an approximate location. |
| We secured your account | You signed in with Google to an address someone else had registered without verifying it, and we removed their password. |
If you did not make the change, reset your password straight away and contact support.
Troubleshooting
| Problem | What to do |
|---|---|
| "This reset link is invalid or has expired" | The link was already used, is older than 30 minutes, or a newer link replaced it. Ask for a new one. |
| No e-mail arrives | Check spam. Wait a minute and try once more. You can only request a few links per hour. |
| "Choose a password you have not used for this account" | Pick a password that is different from your current one. |
| "This account has no password yet" | Your account signs in with Google. Use the add-password link described above. |