Skip to content

Forgotten passwords

Most home servers have no mail relay, so reset is built to work without one.

Administrators cannot set passwords. There is no such button and no such endpoint. Creating an account produces a one-time setup link instead, and the account has no credential at all until the person opens it and chooses one. This follows NIST SP 800-63B, which advises against administrator-chosen and "temporary" passwords — they get shared over chat, reused, and left in place.

Creating an account gives you a one-time setup link. For an existing account, open Admin → People → Manage → Create a reset link. Either way a URL appears on screen to pass on however you like; with mail configured there is also a button to send it directly. Links expire in 24 hours, work once, and issuing a new one invalidates the previous one.

The user does it themselves

Once SMTP is configured (Admin → Mail), a Forgotten your password? link appears on the sign-in page. The user enters a username or email and gets a link valid for an hour. The response is identical whether or not the account exists, so the form cannot be used to discover who has an account here, and requests are throttled per identifier and address.

Nobody can get in at all

The case that used to have no answer: a single administrator who forgets their own password. Run this on the server, as the user that owns the data directory:

sudo longbox-cli reset-password <username>

It prints a one-time link.

What a reset does

Sets the new password, spends the token, drops any other outstanding tokens for that account, and signs out every device — so a reset also evicts anyone who should not have been there. When mail is configured the account owner is also emailed to say their password changed, which is how they would find out about a reset they did not ask for.