Rotate in-app, no email loop required.
Settings → Account → enter current password, new password (min 8 chars, must differ from current), confirm. Stale reset links are nuked on change.
Minimum 8 characters; new password must differ from current. We follow NIST SP 800-63B Rev 4 — no forced character-class rules (no "must contain uppercase + symbol"). Longer passphrases beat short complex passwords; aim for 15+ characters if you're password-only (no MFA yet).
Use the /forgot-password link on the login screen — we email a single-use reset link to your account email. Links expire after 30 minutes.