You can change your login password from Account > Security settings, on the Sign-in and authentication tab.
The moment a password change succeeds, all of the following happen at once:
| What happens | What does not happen |
|---|---|
| Every other session is revoked immediately. The next request from those sessions fails, and they must sign in again. | The device making the change is not affected — its session is explicitly kept. |
| A "Your password was changed" security email is sent asynchronously, with the time, IP address, device, and location. | The email never mentions that other devices were signed out. It only reports the password change itself. |
| The revocation is synchronous with no grace period. The only way back is signing in again on the affected devices. | API keys and tokens are not affected. Connected scripts and integrations keep working. |
- Identity verification is usually required. The exact method depends on what your account has enabled — a password, a passkey, a TOTP code, or an email code. This step is skipped automatically if you verified your identity in security settings within the last hour.
- You are redirected to the account service. Selecting Change password sends you to the Cypacky account service to verify your identity and set the new password, then returns you to the dashboard.
- Check which devices are currently signed in. All of them, except the one you are using now, will be signed out.
-
Go to your account page, then open the Sign-in and authentication tab under Security settings.
Interface illustration：Sign-in and authentication tab showing the password row: the current status text and the Change password button -
On the password row, select Change password. This starts the flow immediately. There is no confirmation dialog, and nothing warns you it will sign out other devices.
-
Complete identity verification if prompted. This step is skipped if you verified recently.
-
On the new password form, enter a password that meets the rules below, enter it again to confirm, then submit.
Interface illustration：Set new password form: the password and confirm-password fields, and where validation messages appear when a password fails a rule -
After a successful submission, the dashboard reloads and shows a "Password updated" notice. Your other sessions are revoked by this point.
Interface illustration：Password updated notice in the top corner of the dashboard after a successful password change
Your new password must meet these rules:
| Rule | Requirement |
|---|---|
| Length | 8 to 72 characters |
| Must include | At least one uppercase letter, one lowercase letter, and one special character |
| Not required | A digit is not required. A password with only uppercase, lowercase, and special characters passes, and nothing in the interface says so. |
| Character range | Letters, digits, and common symbols only. Spaces, most Unicode symbols, and emoji are rejected. |
The 72-character maximum comes from the byte limit of the bcrypt hashing algorithm. Because only ASCII characters are allowed, the character count and the byte count are the same.
The form shows these messages exactly as the interface displays them:
| Interface message | Cause | What to do |
|---|---|---|
| "Please enter new password" | The new password field is empty. | Enter a password that meets the rules above. |
| "New password must be at least 8 characters" | Fewer than 8 characters. | Make the password longer. |
| "New password must be at most 72 characters" | More than 72 characters. The backend hashes with bcrypt, which rejects input over 72 bytes. | Make the password shorter. |
| "Must include an uppercase letter, a lowercase letter and a special character" | Missing at least one of the three required character types. | Add the missing type. A digit does not count toward this. |
| "Contains unsupported characters; only letters, digits and common symbols are allowed" | The password contains a character outside the allowed set, such as a space, most Unicode symbols, or an emoji. | Use only letters, digits, and common symbols. |
| "Passwords do not match" | The password and confirmation fields differ. | Retype both fields so they match. |
| "Failed to start. Please try again." | The request that starts the password-change flow failed, usually due to a network issue. | Retry. If it keeps failing, check your connection. |
Changing your password while signed in and resetting a forgotten password are two different flows with different consequences:
| Comparison | Change password (signed in) | Reset a forgotten password (signed out, email code) |
|---|---|---|
| Which sessions are revoked | All sessions except the one making the change | Every session, including the one making the request |
| Does the follow-up email mention sign-outs | No | Yes — it states that all signed-in devices were signed out |
For more information, refer to Account and security.