Change your password
The Security tab — the three rules, the checklist that shows them, and the sessions a change signs out.
The Security tab has one card on it: Change password. Three fields, a live checklist, and one consequence worth knowing before you press the button.
Change it
Open Account from the avatar menu and go to Security.
Type your current password. This is proof it is you, not a formality — getting it wrong fails the save with "The password is incorrect."
Type the new password twice. The checklist under the field ticks each rule as you satisfy it, from the first keystroke — you never have to submit to find out what was wrong.
The eye icon on each field reveals what you typed, which is worth using on the confirmation field rather than trusting two blind strings to match.
Press Update password. A "Password updated." toast confirms it and the form clears itself.
The rules
| Rule | Why the checklist shows it |
|---|---|
| At least 10 characters | Length does more than any other single rule. |
| Upper and lower case letters | Counted as one rule — you need both. |
| A number | At least one digit. |
Symbols are not required. The same three rules apply everywhere a password is set in the panel — first-run registration, this screen, and an administrator resetting somebody else's — because they come from one definition rather than being spelled out per form.
Two more rules are enforced by the server rather than the checklist:
- The new password must differ from the current one. Re-submitting the password you already have is rejected, not quietly accepted as a change.
- Both new-password fields must match.
The panel deliberately does not check your password against breach databases. That check is a network call to a third party on every submission, and a self-hosted panel that may have no outbound access should not fail a password change because it could not reach somebody else's API.
What a change does to your sessions
Changing your password revokes every API token on your account. In practice:
- The browser you changed it in stays signed in. It is issued a fresh token as part of the same response, which is why you are not bounced to the login screen.
- Every other session is signed out — another browser, your phone, a tab you left open on another machine.
- Anything using a token of yours stops working, including scripts against the API. They need the new token.
That is the intended behaviour of a password change and the reason to do one after a device goes missing. It is not announced by the UI, so it is worth knowing before you change your password on a laptop and walk away from a half-finished deploy running under your token somewhere else.
The change is recorded as Changed their own password in
your activity and, when an administrator
resets somebody else's, as Password reset by an administrator instead — the
two are distinct events on purpose.
If you are locked out
A panel account has no email address, so there is no "forgot password" link and no reset email. Two ways back in:
- Ask another administrator to reset it for you from the admin area.
- If you are the only administrator, the only way back is a shell on the server — the panel ships no password-reset command, so it is a Laravel console session against the panel's own database. You need SSH access to the box to do it, which is the point: the recovery path is "prove you own the machine".
Caveats
- No two-factor authentication. The panel does not offer it on any account.
- No password expiry, history or reuse check. Nothing forces a rotation and nothing stops you returning to an older password later.
- This form is not rate-limited. The login and registration endpoints are throttled; changing a password is not, because reaching it already requires a valid session.
- Needs no permission beyond being signed in.