Account recovery
Enter your registered email and we'll send a secure reset link.
Reset links expire after one hour and are single-use. Your previous password stays active until you complete the reset.
Token expiry
Reset links are valid for 60 minutes then invalidated.
Enum-safe responses
The same message shows whether an email is registered or not.
Rate limited
Requests are throttled per IP to prevent abuse.
Hashed passwords
Passwords are stored using bcrypt — never in plain text.