# Password reset

A step of the [Cloud application](https://gradus.kazet.blog/tree/cloud-application) tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Page: https://gradus.kazet.blog/tree/cloud-application/step/password-reset

Reset passwords and verify addresses by email with one mechanism: single-use, short-lived tokens stored only as a hash.

One option of Sign-in: Passwords you own. The others: Hosted identity provider.

Usually comes after: [Passwords & sessions](https://gradus.kazet.blog/tree/cloud-application/step/passwords-and-sessions).

## Prompt for your AI assistant

```
Read the sign-in decision record in docs/decisions and the email module. Add one token mechanism for password reset and address verification: a random single-use token that expires, stored only as a hash and sent through the email module. Build the forgot password page and the reset page, answer the same whether or not the address has an account, end every session of that user after a reset and tell them by email that it happened. Send a verification link at sign-up and mark the identity verified when it is used. Add tests for an expired token, a reused token and an unknown address, then walk through a real reset with an inbox I give you.
```

Every step of the tree: https://gradus.kazet.blog/tree/cloud-application/llms.txt