diff options
Diffstat (limited to 'docs/user_guide/password_management.md')
| -rw-r--r-- | docs/user_guide/password_management.md | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/docs/user_guide/password_management.md b/docs/user_guide/password_management.md index f6e2de1b2..1ed701919 100644 --- a/docs/user_guide/password_management.md +++ b/docs/user_guide/password_management.md @@ -1,19 +1,19 @@ # Password Management -GoToSocial stores hashes of user passwords in its database using the secure [bcrypt](https://en.wikipedia.org/wiki/Bcrypt) function in the [Go standard libraries](https://pkg.go.dev/golang.org/x/crypto/bcrypt). +## Change Your Password -This means that the plaintext value of your password is safe even if the database of your GoToSocial instance is compromised. It also means that your instance admin does not have access to your password. +You can use the [User Settings Panel](./user_panel.md) to change your password. Just log in to the user panel, scroll to the bottom of the page, and input your old password and desired new password. -To check whether a password is sufficiently secure before accepting it, GoToSocial uses [this library](https://github.com/wagslane/go-password-validator) with entropy set to 60. This means that passwords like `password` are rejected, but something like `verylongandsecurepasswordhahaha` would be accepted, even without special characters/upper+lowercase etc. +If the new password you provide is not long/complicated enough, you will see an error and be prompted to try again with a different password. -We recommend following the EFF's guidelines on [creating strong passwords](https://ssd.eff.org/en/module/creating-strong-passwords). +If your instance uses OIDC (ie., you log in via Google or some other external provider), you will have to change your password via your OIDC provider, not through the user settings panel. -## Change Your Password +## Password Storage -### API method +GoToSocial stores hashes of user passwords in its database using the secure [bcrypt](https://en.wikipedia.org/wiki/Bcrypt) function in the [Go standard libraries](https://pkg.go.dev/golang.org/x/crypto/bcrypt). -If you are logged in (ie., you have a valid oauth token), you can change your password by making a POST request to `/api/v1/user/password_change`, using your token as authentication, and giving your old password and desired new password as parameters. Check the [API documentation](../api/swagger.md) for more details. +This means that the plaintext value of your password is safe even if the database of your GoToSocial instance is compromised. It also means that your instance admin does not have access to your password. -## Reset Your Password +To check whether a password is sufficiently secure before accepting it, GoToSocial uses [this library](https://github.com/wagslane/go-password-validator) with entropy set to 60. This means that passwords like `password` are rejected, but something like `verylongandsecurepasswordhahaha` would be accepted, even without special characters/upper+lowercase etc. -todo +We recommend following the EFF's guidelines on [creating strong passwords](https://ssd.eff.org/en/module/creating-strong-passwords). |