> ## Documentation Index
> Fetch the complete documentation index at: https://help.qrtub.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Change Your Password

> Changing your QRtub password from the Profile screen: the four rules actually enforced, the live checklist, the five-per-15-minutes limit, and what to do if you never set a password

Change your password from the Profile screen. Open the user menu at the top right of the
dashboard, choose **Profile**, scroll to **Change Password**, enter the new password twice and
click **Update Password**.

You are not asked for your current password — being signed in is the proof. On success the form
shows *Password updated successfully.* and clears both boxes. It does not sign you out or send
you anywhere, so you can carry on working.

## The password rules

Four requirements, all enforced before the request is sent and again by the authentication
service:

* At least **8 characters**
* At least one **upper case** and one **lower case** letter
* At least one **number**
* At least one **special character** from `!@#$%^&*()_+-=[]{};':"\|,.<>/?`

There is no maximum length and no restriction on what else the password contains. A space is
allowed inside a password but does not count as the special character.

A checklist under the New Password box ticks each rule off as you meet it, plus a *Passwords
match.* row once you have filled in the confirmation. That checklist updates about half a
second after you stop typing, so it can lag behind fast typing or a password manager filling
the field — the check performed when you click **Update Password** is the one that decides.

If a rule is unmet, the form names the first one it hits, for example *Password must contain at
least one special character.* Anything the authentication service itself rejects is shown to you
verbatim in a red box above the form — that is where you would see it if the new password is the
same as the one you already have.

## If you never set a password

If someone invited you to a team and you had no QRtub login yet, your invitation email contains
a one-time link that signs you in and lands on a **Set a password** screen. It enforces the same
four rules, and setting a password there takes you straight to the dashboard.

That screen also offers **Skip for now**. Taking it leaves you signed in with no password set,
so on your next visit the password box on the login screen will not work for you — set a
password from the Profile screen while you are still signed in, or use the recovery email flow
below. The Set a password screen and the Profile form submit to exactly the same place, so
either route gets you to the same result.

## If you cannot sign in

Use **Forgot password** on the login screen and enter your email address. QRtub sends a recovery
email; opening its link brings up **Reset your password**, which applies the same four rules.
After saving, you are returned to the login screen a few seconds later to sign in with the new
password.

Two failure messages are worth recognizing. *This reset link is invalid or has expired. Please
request a new one.* means the recovery link is no longer usable — request another from Forgot
password. An unauthorized error on the Profile form means your session has ended; sign in again
and retry.

## The rate limit

Password updates are limited to **five per 15 minutes per account**, counted across both the
Profile form and the reset screen. Past that you get *Too many requests. Please try again later.*
along with how long to wait. Nothing is locked and nothing needs to be reset — the next attempt
after the window succeeds.

## Related

* [Account Overview](/account/overview) — everything else the Profile screen shows, and what it will not let you change
* [Accepting a Team Invitation](/team/accept-invitation) — the invitation link that leads to the Set a password screen
* [Team Overview](/team/overview) — how your login relates to the team that owns your Collections