> ## Documentation Index
> Fetch the complete documentation index at: https://ownpay.org/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> OwnPay is licensed under AGPL-3.0 and is completely free - no licensing fees.
> Production docs URL: https://ownpay.org/docs - append .md to any page URL for clean markdown.
> OwnPay requires PHP 8.3+, MySQL/MariaDB, and Redis.
> MCP server available at https://ownpay.org/docs/mcp for programmatic documentation queries.
> Use root-relative links (e.g. /quickstart) for internal navigation - do NOT include /docs prefix.
> Plugin development: consult /developer/plugins/ pages for correct interfaces and manifests.
> Canonical locations: API auth = /api/authentication, webhook verification = /api/webhooks, rate limits = /resources/rate-limiting, transaction statuses = /fundamentals/payment-flow.
> The documentation uses the Diataxis framework: Tutorials (learning), How-to (tasks), Reference (lookup), Explanation (understanding).

# Password Reset

> Request a password reset via email link, configure link expiry, and learn how super-admins can reset passwords for other staff members.

OwnPay provides a secure password reset flow that sends a time-limited link to the staff member's registered email address.

## Request a password reset

<Steps>
  <Step>
    On the [login page](/docs/security/login), click **Forgot password?**.
  </Step>

  <Step>
    Enter the email address associated with your account.
  </Step>

  <Step>
    OwnPay sends a reset link to that email. The link expires after a configurable duration (default: 30 minutes).
  </Step>

  <Step>
    Click the link in the email and set your new password.
  </Step>
</Steps>

<Note>
  The reset link can only be used once. Requesting a new reset link invalidates all previous links.
</Note>

## Password requirements

New passwords must meet the policy configured in **Settings > Security**:

* **Minimum length** - 12 characters (default)
* **Complexity** - Must include at least one uppercase letter, one lowercase letter, and one number
* **History** - Cannot reuse any of your last 5 passwords

## Reset link expiry

The super-admin can configure the reset link lifetime in **Settings > Security > Reset Link Expiry**. Values are set in minutes. A shorter expiry improves security; a longer expiry is more convenient.

## Super-admin password reset

If a staff member cannot access their email, the super-admin can manually reset their password:

1. Go to **People > Staff**
2. Find the user and click **Reset Password**
3. Enter and confirm the new password
4. The staff member is forced to change their password on next login

<Warning>
  Super-admin password resets are logged in the [audit log](/docs/reports/audit-log). Use this power sparingly and only when the standard email reset flow is unavailable.
</Warning>

## Related Pages

* [Login](/docs/security/login) - The login page where password reset is initiated
* [Two-Factor Authentication](/docs/security/two-factor) - Re-enroll 2FA after a password reset
* [My Account](/docs/security/my-account) - Change your password without a reset link


## Related topics

- [Email Notifications](/docs/notifications/email.md)
- [Invite and manage staff](/docs/people/staff.md)
- [My Account](/docs/security/my-account.md)
- [Rate Limiting](/docs/resources/rate-limiting.md)
- [Two-Factor Authentication](/docs/security/two-factor.md)