Password

Set or change the password on your account, what the strength meter tells you, and how passwords are checked against known breaches.

On this page

Every TDACorp account has a password: you choose it when you create the account, and a passkey, a second step or a linked account can sit beside it. The Password tab, titled Password, says it lets you set or change the password on this account.

Passwords are stored only as an Argon2id hash, a one-way fingerprint, so the platform cannot read yours. See Security practices.

Set a password#

An account that was made before every account needed a password can have none. If no password is set, the tab says No password is set. You sign in with a passkey or a linked account. The section is titled Set password.

Open Security, then the Password tab.
Type the password in New password and again in Confirm new password.
Select Set password.
The page says Password set.

An account with no password cannot finish a sign-in either: the next sign-in stops on Choose a password until one is set, so this tab is only a way to do it earlier.

The Password tab of the security settings: a Change password form with the current password, a new password with a strength hint, and its confirmation, an option to also revoke personal access tokens, and a Change password button. — Password: change it, with your current one. Sample data./account/security/password

Change your password#

Open the Password tab. The section is titled Change password.
Type your Current password, then the New password and Confirm new password.
Tick Also revoke my personal access tokens if you want any access tokens you created to stop working too. See Connected applications.
Select Change password. The page says Password changed.

A wrong current password is refused. Changing the password signs your other devices out and keeps this one signed in, and the page says so under the form: Other signed-in devices are signed out. This one stays signed in. A security email goes to your verified addresses.

If the two new passwords differ, the page says The two passwords are not the same. and sends nothing.

The rules#

The hint under New password states the rule the platform sends: Use 12 to 256 characters. There are no required mixes of capitals, digits or symbols. Length is what counts, and a long phrase you can remember is better than a short complicated one.

The strength meter#

As you type, a bar labelled Strength moves and a line says how you are doing.

What it says	Meaning
Too short: use at least 12 characters.	Under the minimum. The password will be refused.
Fair. Longer is stronger.	Just over the minimum.
Good.	A comfortable length.
Strong.	A long password.

The meter looks at length only. Under it the page says This is advice only. We make the final check when you save. A long password made of a common phrase can read as Strong and still be refused or be easy to guess, so do not reuse a password from elsewhere.

The breach check#

Where the platform has the check turned on, the hint adds New passwords are also checked against known breaches. When you save, the password is looked up in a public list of passwords that have appeared in data breaches, using a range lookup that sends only a short prefix of a one-way fingerprint of it and never the password itself. A match is refused. A password that has been in a breach is not safe even if it is long, because attackers try known passwords first.

The Security checkup also looks at this. If your password later turns up in a breach, the checkup shows Password as At risk and says to change it now.

You cannot remove your password#

The Password tab offers Set password and Change password only. Once a password is set, it can be changed but not removed. If you rely on passkeys, you can keep the password and sign in with a passkey.

Forgot your password#

Use Forgot password? on the sign-in page. You cannot do this from inside your account, because you are not signed in. See Signing in.

Managed accounts#

An account that an organization manages (a managed identity) cannot add, change or remove its own sign-in methods here: those requests are refused, because the organization's directory connection is its only way in.