# Change your account password Changing your password immediately revokes your other sessions with no confirmation prompt. This page covers the consequences, the steps, and the password rules. You can change your login password from **Account > Security settings**, on the **Sign-in and authentication** tab. > [!CAUTION] > The moment the change succeeds, every other session on this account is revoked > except the one making the change. Those devices must sign in again. There is > no confirmation dialog anywhere in this flow, and the follow-up security email > never mentions the sign-outs. Confirm you do not need to stay signed in > elsewhere before you select **Change password**. ## What changing your password does The moment a password change succeeds, all of the following happen at once: | What happens | What does not happen | | --------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | | Every other session is revoked immediately. The next request from those sessions fails, and they must sign in again. | The device making the change is not affected — its session is explicitly kept. | | A "Your password was changed" security email is sent asynchronously, with the time, IP address, device, and location. | The email never mentions that other devices were signed out. It only reports the password change itself. | | The revocation is synchronous with no grace period. The only way back is signing in again on the affected devices. | API keys and tokens are not affected. Connected scripts and integrations keep working. | ## Before you begin - **Identity verification is usually required.** The exact method depends on what your account has enabled — a password, a passkey, a TOTP code, or an email code. This step is skipped automatically if you verified your identity in security settings within the last hour. - **You are redirected to the account service.** Selecting **Change password** sends you to the Cypacky account service to verify your identity and set the new password, then returns you to the dashboard. - **Check which devices are currently signed in.** All of them, except the one you are using now, will be signed out. ## Change your password 1. Go to your account page, then open the **Sign-in and authentication** tab under **Security settings**. _Interface illustration: Sign-in and authentication tab showing the password row: the current status text and the Change password button_ 2. On the password row, select **Change password**. This starts the flow immediately. There is no confirmation dialog, and nothing warns you it will sign out other devices. 3. Complete identity verification if prompted. This step is skipped if you verified recently. 4. On the new password form, enter a password that meets the rules below, enter it again to confirm, then submit. _Interface illustration: Set new password form: the password and confirm-password fields, and where validation messages appear when a password fails a rule_ 5. After a successful submission, the dashboard reloads and shows a "Password updated" notice. Your other sessions are revoked by this point. _Interface illustration: Password updated notice in the top corner of the dashboard after a successful password change_ ## Password requirements Your new password must meet these rules: | Rule | Requirement | | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | Length | 8 to 72 characters | | Must include | At least one uppercase letter, one lowercase letter, and one special character | | Not required | A digit is not required. A password with only uppercase, lowercase, and special characters passes, and nothing in the interface says so. | | Character range | Letters, digits, and common symbols only. Spaces, most Unicode symbols, and emoji are rejected. | The 72-character maximum comes from the byte limit of the bcrypt hashing algorithm. Because only ASCII characters are allowed, the character count and the byte count are the same. ## If the form rejects your password The form shows these messages exactly as the interface displays them: | Interface message | Cause | What to do | | -------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- | | "Please enter new password" | The new password field is empty. | Enter a password that meets the rules above. | | "New password must be at least 8 characters" | Fewer than 8 characters. | Make the password longer. | | "New password must be at most 72 characters" | More than 72 characters. The backend hashes with bcrypt, which rejects input over 72 bytes. | Make the password shorter. | | "Must include an uppercase letter, a lowercase letter and a special character" | Missing at least one of the three required character types. | Add the missing type. A digit does not count toward this. | | "Contains unsupported characters; only letters, digits and common symbols are allowed" | The password contains a character outside the allowed set, such as a space, most Unicode symbols, or an emoji. | Use only letters, digits, and common symbols. | | "Passwords do not match" | The password and confirmation fields differ. | Retype both fields so they match. | | "Failed to start. Please try again." | The request that starts the password-change flow failed, usually due to a network issue. | Retry. If it keeps failing, check your connection. | ## How this differs from resetting a forgotten password Changing your password while signed in and resetting a forgotten password are two different flows with different consequences: | Comparison | Change password (signed in) | Reset a forgotten password (signed out, email code) | | ------------------------------------------ | --------------------------------------------- | ---------------------------------------------------------- | | Which sessions are revoked | All sessions except the one making the change | Every session, including the one making the request | | Does the follow-up email mention sign-outs | No | Yes — it states that all signed-in devices were signed out | ## Related pages For more information, refer to [Account and security](/account/overview/).