Change or reset your password

Choose change or reset

Settings → Security → Password shows whether the account already has a password. Change password is for a known current password. Email me a reset link is the recovery route when you do not know it, and can add a password to an eligible account currently using Google or a passkey. These actions affect the account credential rather than a particular chart or browser tab. Before beginning, confirm that the email shown in Account is the address whose inbox you can access.

Create a password the form accepts

Use a long, unique password of at least 12 characters. The current validation also bounds the encoded password to 128 bytes, so a password containing many multibyte characters can reach the byte ceiling before a simple character counter suggests it would. The new password must differ from the current one and match its confirmation exactly. Check keyboard layout and accidental leading or trailing spaces. A password manager can help keep the exact value available without reusing a credential from another service.

Change a known password

Open Security and complete the Current password, New password and Confirm new password inputs. The current value verifies that you control the existing credential; the two new fields check your intended replacement. Wait for the successful change result rather than closing the tab while it says Changing. An incorrect-current-password response means the existing password was refused and the new one has not been established. Correct the current value or move to email recovery instead of repeatedly submitting the same failed combination.

1. Enter the current password in the dedicated field.
2. Enter and confirm a different password that meets the displayed limits.
3. Choose Change password and wait for the completed result.

Request a recovery link

Choose Email me a reset link from Security, or use the available forgot-password route on the sign-in screen. The request uses the account email and depends on a configured email sender. A message saying email is not configured describes a service limitation; it is not an instruction to disclose your password to support. Once the request succeeds, check both the inbox and spam folder. The reset request itself does not change the password, sign out an attacker or prove the message reached your mailbox.

Complete the single-use reset

Open the current reset message and follow its link within the 30-minute lifetime. Enter the new password and matching confirmation on the reset page, then wait for the reset to finish. A link can be invalid because it expired or was already consumed. Begin a fresh reset request in that case; editing the URL or reusing an old message will not restore its authority. If you did not request a reset, ignore the message rather than following a credential-changing action you did not intend.

Expect session changes after success

A successful password reset revokes every account session, so sign in again with the new password after completing recovery. Changing a known password from Security preserves the current session and revokes the other sessions. Other devices therefore need to sign in again, while the browser performing a normal password change can continue in its current session. This is different from a failed password request that left the old credential unchanged. Sign in with the newly established password when needed, verify the account email and reopen your saved workspace. Account resources remain associated with the same account rather than being copied into a new identity.

Troubleshoot recovery without sharing proofs

For a missing message, provide the approximate request time and the safe delivery or configuration error. For an invalid-reset response, request one current link and complete it promptly rather than opening multiple old links. Too many attempts can temporarily limit requests, so honor the displayed wait instead of generating a burst. Support can investigate the account and service state without receiving a password, full reset URL, verification token or browser cookie. Real inbox arrival and mail-client rendering remain separate from the application's implementation and provider acceptance.