Flows/Reset password
Valere CRM · Design foundations

Flows

Reset password

Live app layoutIn the app

A forgotten password, from the link on the sign-in page to a new password, in the chosen sign-in layout. The new password is checked as it is typed: pick Set a new password · try it in the list of screens and type one.

Press the buttons and links on a screen to follow the flow. Nothing is sent or saved here.

The screens follow ForgotPassword.tsx and RestorePassword.tsx. The two halves are the app's since 2026-10-07 (ADR-0041). Proposed beyond the app: the strength bar, and every password rule except the length, which is all the API checks today (item 6 of App changes). Screens marked Design only are on the design boards but not in the app.

Restore your passwordReached from Forgot password? on Sign in.
/auth/forgot-password
The same button can also end here:Not an emailToo many requests
Restore · not an emailChecked in the browser. Only the format is checked, never whether an account exists.
/auth/forgot-password
Restore · sendingThe button is off until the answer comes back, so one press sends one email.
/auth/forgot-password
When the answer comes:Check your email
Check your emailShown for any email, whether it has an account or not, so the page never confirms one.
/auth/forgot-password
Outside the app:Open the link from the email
Check your email · sent againA new link replaces the one before, which stops working. Send again pauses for a minute after each send.
/auth/forgot-password
Outside the app:Open the link from the email
Restore · too many requests Design onlyAfter repeated requests sending pauses, whatever the email, so the form cannot flood an inbox.
/auth/forgot-password
Set a new password · try itOpened by the link in the email. Type a password: each rule turns green as it holds, and the bar says how strong it is. Set new password then leads to the screen its answer would show.
/auth/restore-password?token=…
Also possible here:TypingEvery rule metThe link was already used
Set a new password · typing"Orchard26" is long enough and has a number and both cases. No symbol yet, so four rules are open and the bar reads Fair.
/auth/restore-password?token=…
Set a new password · every rule met"Orchard-2026" in both fields: all five rules hold, and twelve characters make it Strong.
/auth/restore-password?token=…
Set a new password · too weakSent while a rule is open. Checked in the browser, nothing is sent; the open rules turn red.
/auth/restore-password?token=…
Set a new password · do not matchThe password passes every rule, but the confirmation differs. Checked when the form is sent.
/auth/restore-password?token=…
Set a new password · savingEvery rule holds. The button is off until the answer comes back, so the link is used once.
/auth/restore-password?token=…
When the answer comes:Password updated
Set a new password · link used or expiredA link works once and for 30 minutes. A used, expired, replaced or broken link gets one message and no form.
/auth/restore-password?token=…
Password updatedThe reset ends every session of the account and signs no one in. The user lands on Sign in and uses the new password.
/auth/sign-in
From here:The Sign in flow

The password rules

A new password must meet every rule. The strength bar only informs: one point for each of the first four rules and one more for 12 characters or longer. Up to 2 points is Weak, 3 Fair, 4 Good, 5 Strong.

RuleChecked todayIn this design
8 to 72 charactersBy the API and the browser, on every new password. Counted in bytes, so some symbols count as more than one.The same
A numberOnly when an admin creates a staff userEvery new password
An upper-case and a lower-case letterNot checkedEvery new password
A symbol, such as - ! or #Not checkedEvery new password
Both passwords matchBy the browserThe same

Behind the screens

Not built yet