Your password is set in one place and used in one place, and changing it is also how you end a session you no longer trust.
Changing your password
- Open Settings and go to the profile section, or use Profile settings in the account menu at the bottom of the sidebar.
- Find the Password card. Its subtitle says when the password was last changed.
- Type your current password, then a new one of at least 8 characters.
- Press Change password.
The password card in settings with the current and new password fields.
A confirmation appears saying what happened: you stay signed in here, and every other browser is signed out.
That second half is the point. Changing a password is what people do after a shared laptop, a stolen phone or a colleague leaving, and a change that left those sessions alive would have achieved nothing. The browser you are typing in is spared, because signing you out of it would be a poor reward for good hygiene.
The new password has to be different from the old one, and you have to prove you know the old one before you can set it.
If you signed up with Google, Microsoft or Facebook
An account created through a social sign-in has no password to change, so you are not asked for a current one. Setting a password there is an addition rather than a replacement: the social sign-in keeps working and you gain a second way in.
Your Google, Microsoft or Facebook password is separate from this and we never see it or store it. Changing it there changes nothing here.
Forgetting your password
Resetting is a link sent to the address on the account. The link lives for 1 hour and works once. Following it lets you set a new password, and doing so signs out every session on the account, including any that somebody else was using, which is the whole reason to reset rather than change.
You are told a link is on its way whether or not the address has an account here, so the screen is never a way to find out who has an account.
Repeated failed sign-ins
There is no permanent lockout. Repeated failures slow the next attempt down instead, and the slowdown is tied to your address and your network, so nobody can lock you out by failing on purpose from somewhere else.
- The first 5 failed attempts cost nothing. People mistype passwords.
- From the sixth, each further failure makes the next attempt wait longer, starting at a couple of seconds and doubling, up to a ceiling of 15 minutes.
- The counter forgets itself after an hour without a failure, so yesterday's mistakes never affect today.
- A successful sign-in clears it immediately.
If you are being asked to wait, the message says how long. Waiting it out and typing the password carefully is faster than anything else you could do, and resetting your password also clears the counter.
Choosing a password
Use at least 8 characters. A passphrase of a few unrelated words beats a short clever one, and a password manager beats both. Do not reuse the password from any of your social accounts here: the point of keeping them separate is that one being exposed does not cost you the other.