/reset — request (unconditional 202, no enumeration) → confirm (new password + policy)

Reset password

Forgot your password?

Enter your email and we'll send a reset link if an account exists.

Back to sign in

Check your email

If an account exists for ada@lovelace.io, a password reset link is on its way. The link expires in 30 minutes.

Set a new password

Choose a strong password you don't use anywhere else.

Reset link expired

This link is no longer valid. Request a new one to continue.

No account enumeration. POST /session/password/reset-request always returns 202 and the same "check your email" copy — an attacker can't tell a registered address from an unregistered one. The confirm step enforces the same 12+ policy as signup.