Change your password
You can change your password at any time from Settings while signed in. If you have forgotten it, the sign-in page sends a reset link by email. Either way the old password stops working immediately and other sessions are signed out, so a lost laptop or a shared computer is cut off.
Who can do this: Everyone for their own account; no permission key is involved. An Admin or HR Manager can also set a new password for an employee from the employee record.
Where to find it
Settings → Password in the sidebar (`/settings/general`, then the Password tab). Forgotten passwords: `/forgot-password` from the Forgot your password? link on the sign-in page.
Changing your password while signed in
- Open Settings and press the Password tab.
- Enter your Current password. This is required even though you are already signed in, so that someone who finds your open session cannot lock you out.
- Enter the New password and repeat it in Confirm new password. At least 8 characters; both must match.
- Press Update password. The form clears and shows Password changed.
If the current password is wrong the message is "Current password is incorrect." If the two new fields differ, "New password and confirmation do not match."
Resetting a forgotten password
- On the sign-in page press Forgot your password?.
- Enter your Email and press Send reset link. The page always says "If an account exists for that email, a reset link has been sent."
- In the email, follow the link. Choose a new password asks for New password and Confirm password, at least 8 characters. Press Reset password.
- You see "Password reset. You can now sign in with your new password." Press Back to sign in.
Reset links are tied to your email address and expire; an old link shows "This reset link is invalid or has expired. Request a new one."
What happens next
| Action | Sessions | Notifications and records |
|---|---|---|
| Update password in Settings | Every other device is signed out; this browser stays signed in. | An audit log entry records the change (no details stored). An in-app notice You were signed out of your other sessions may appear on those devices. |
| Reset password by email | Every session everywhere is signed out, including the one that requested the link. | The link cannot be reused. |
| Password set by HR from your record | All sessions are revoked. | HR's action is audited against their name. |
Two-factor authentication is unchanged by a password change. Trusted devices are not affected either; use Forget them on Settings → Security if you want those revoked too.
Rules and limits
- Minimum 8 characters, no other complexity rule is enforced. Use a long, unique password; a password manager is the practical answer.
- The reset email goes only to the address on your record. ZekoHR never reveals whether an address exists.
- Password forms are rate limited together with sign-in. Repeated failures lock the email and network address pair for 15 minutes.
- Changing the password does not change your email. Email changes are made by HR.
- Passwords are never shown or sent in plain text, including to Admins.
Troubleshooting
The reset email does not arrive. Check spam and confirm with HR which address is on your record. If your organisation uses a custom email domain, delivery may take a minute.
I was signed out on my phone after changing the password on my laptop. Expected. Sign in again on the phone with the new password.
I set a password from the invitation link but now it is rejected. The invitation link may have been used twice, or HR re-sent it, which invalidates earlier ones. Use Forgot your password? to set a fresh one.
Update password is disabled. It is disabled only while a request is in flight. Reload if it stays disabled.