# Password recovery

If you lose your password, `/auth/recover` can email you a link to set a new one.
Email recovery is unavailable while **Require a passkey** is enabled: use your
passkey to sign in. This setting is a passkey-only policy: password sign-in is
rejected rather than followed by a second passkey step. Recovery also requires
the deployment's mail service to be configured.

## Requesting a link

Enter the email address on your account and press **Send recovery link**. The
page always reports that a link is on its way if an account exists; it does
not reveal whether one does or whether passkey requirements prevent recovery.
The link expires in 15 minutes. A new request replaces the earlier link, except
that repeat requests within 60 seconds leave the current link in place.

## Setting the new password

The emailed link opens `/auth/recover-password` with the token filled in. Enter
a new password of at least 12 characters twice; the button stays disabled until
both match. Completing recovery:

- sets the new password,
- signs out every existing session,
- revokes every passkey and account token grant, including CLI logins and
  authentication grants bound to SSH keys.

You are then asked to sign in again with the new password. A used, expired or
tampered link is refused; request a new one.

## Recovering passkey-only access

Before you lose access, enable **Require a passkey**, then open **Settings →
Account** and generate recovery codes.
Confirm the action with a recent password or passkey prompt. Save all eight codes
offline: each contains 128 random bits and the plaintext is shown only in that
response. Generating a replacement set immediately invalidates the old set.
Changing the passkey requirement also changes the authentication epoch and
invalidates the set; generate new codes after enabling it. If replacement fails
after being requested, the outcome may be uncertain: do not use the displayed
old set, and generate a fresh set.

If every passkey is unavailable, open `/auth/recover`, expand **Use a recovery
code**, and enter your account email, one saved code, and a new password. A valid
code consumes the entire remaining set, disables passkey-only sign-in, changes
the password, and revokes all existing sessions, passkeys, token grants, and
pending account-recovery proofs. Sign in again with the new password, then add
new passkeys and generate a new recovery-code set. Invalid, old, and already-used
codes all produce the same failure.