Changing your password

There are two situations, and they need different things. If you can still get into Cordice, you change your password from inside it. If you cannot, you ask for a reset by email.

While you are signed in

You will need your current password as well as the new one. That is deliberate: it means somebody who walks up to an unlocked screen cannot lock you out of your own account in four seconds.

In a browser or the desktop app

1. Open Settings.
2. Click My Account at the top of the settings list.
3. Choose Password.
4. Enter your current password, then the new one, and confirm.

On Android

1. Open Settings, then Login & Security.
2. Choose Password.
3. Enter your current password, then the new one, and confirm.

When you cannot get in

1. On the sign-in screen, choose Reset password.
2. Enter the email address the account uses. You may be asked to complete a check that you are not a machine.
3. Open the email we send and follow the link in it.
4. Set the new password.

On that last screen there is a box marked Log out of all other sessions. Tick it if there is any chance somebody else knows the old password — a password change on its own does not end sessions that are already signed in, so without it whoever else was there stays there.

The Android app does not have its own reset screen. Its Forgot password? link opens the web app at the same place, and once you have set the new password you can sign in on your phone with it.

If the email does not arrive, check the spam folder first, then confirm you typed the address the account actually uses. We will not tell you whether an address has an account attached to it — that would let anyone check who is registered here — so a silent reset request is what a wrong address looks like.

Choosing the new one

Length beats cleverness: a long passphrase you can remember is stronger than a short one with symbols in it. Use a password you have not used anywhere else, so that somebody else’s leak is not also yours, and let a password manager remember it. If you would rather not rely on the password alone, turn on two-step verification.