---
id: SCR-PFM-SEC-018
title: Reset password
route: /resetPassword
surface: console
product_area: platform
module: security
revision: 1
status: draft
design_intent: proposed
implementation_evidence: observed
inference: []
source_sha:
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
purpose: Apply a recovery code and a new password under provider policy.
supports:
- CAP-PFM-SEC-006
permission: 'none: public'
entry_from:
- /checkEmail
exits_to:
- /login
displays:
- field: Recovery-code and new-password inputs with password guidance.
  source: Console pool password policy
  provenance: observed
actions:
- label: Reset password
  operation_id: Console pool confirm-forgot-password (Cognito)
  permission: none
  confirm: false
  provenance: observed
  source: react-console:components/auth/screens/reset-password-screen.tsx
states:
- loading
- error
validation:
- BR-CAP-PFM-SEC-006-08
patterns:
- Authentication layout
- FormAlert
- FieldError
- Password strength meter
component: components/auth/screens/reset-password-screen.tsx (ResetPasswordScreen)
evidence:
- 'react-console at baf6dae: components/auth/screens/reset-password-screen.tsx; the page route file; lib/security/api.ts,
  lib/hq/platform-ops.ts, lib/hq/platform.ts, lib/auth/*'
examined_at: '2026-10-23'
examiner: codex
controls: [TC-AVL-001, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-006, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-002, TC-MON-003, TC-PI-001, TC-PI-003, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-SEC-001, TC-SEC-002, TC-SEC-003, TC-SEC-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Reset password

## What the Screen Is For

Apply a recovery code and a new password under provider policy.

## What It Shows and Lets People Do

The form validates code/password inputs and submits provider recovery confirmation. Successful reset leads back to sign-in rather than silently establishing a session.

## States and Errors

Password guidance and provider errors remain visible. The provider, rather than this screen, determines whether the code can still be used.

The state rows describe observed loading, empty, refusal or inactive handling where present. Linked validation rules belong to the planning layer; client feedback and authoritative service checks have distinct responsibilities.

## Patterns It Must Respect

The pattern list names the built shared components and interaction patterns checked for this screen. This contract describes the existing screen; it supplies no replacement visual design.