Rekey research · measured study
How to change an at-risk password without getting locked out: tested on 28 real sites
TL;DR
To change an at-risk password without getting locked out, do it in this order:
- Check the saved password works before you change anything. When I ran the steps on three sites on 4 October 2026, two of the three saved passwords were already wrong.
- Have your email and phone open. 6 of 28 sites stopped the change to ask for a code or an extra password, and on 7 I had to leave the site at some point to fetch a code.
- Sign in with the new password in a private window before you sign out anywhere else. That check stops a half-failed change from turning into a lockout.
- If it half-fails, stop retrying. Work out which password the site holds and make the vault match. Here's how.
Study 1 · 28 sites · first attempt
6 of 28 sites couldn't be changed at all
- Changed on the first try
- Changed after a failed first attempt
- Not changed (4 form not found in the time given, 2 blocked at the form)
Your password manager flagged a password and you're about to change it. On 13 August 2026 I timed 32 password changes across 28 sites using my own accounts (raw data), and on 4 October 2026 I ran the steps on Canva, Shopify and Ticketmaster.
What is the easiest way to change a password?
The easiest way to change an at-risk password is to follow a set order, because the order matters more than the tool. On Ticketmaster, my near-lockout came from the vault keeping the old password after the site took the new one.
Tick each step as you go.
- Open the alert inside your password manager. Don't follow a link in an email, and know which account it is and why it was flagged.
- Get your email and phone ready before you touch anything.My order Open the inbox and the phone the site sends codes to, with your recovery codes nearby. In my test, 6 of 28 sites stopped partway to ask for a code or an extra password, and on 7 of 28 I had to leave the site at some point to fetch a code.
- Check that the saved password still works.My order Sign in fresh with it, because change forms often ask for the current password. If the site won't accept it, sort that out first. 1Password's own guide says the same: "Before you change a password, make sure the current password for the site is saved in 1Password."
- Find the change-password form. Use your password manager's link if it has one, otherwise the site's account or security settings. Only 4 of 28 sites let me find it through their own menus.
- Save the new password in the vault as you submit it. Generate it in your password manager, and don't submit and walk away. 1Password's order is to select Update in 1Password first, then Save on the website. Keep the old password until step 6 is done; 1Password and Bitwarden both keep it in the item's history.
- Test the new password before you sign out anywhere else.My order Sign in with it in a private window. If you sign out everywhere first and the new password doesn't work, you're locked out.
- If it half-failed, stop. Retrying only adds failed attempts. Work out which password the site holds now, then follow what to do when a change half-fails.
Steps 2, 3 and 6 are my own order, worked out from Study 1 and from where people get stuck, not a password manager's rule. On 4 October 2026 I ran all seven on Shopify, which failed in Study 1, and on two new sites, Canva and Ticketmaster.
| Site | Result | What happened |
|---|---|---|
| Canva | Caught at step 3 | The saved password was already wrong, and step 3 caught it. Canva pushed a passkey at sign-in and put the password option three screens in, but the change went through on the first try. |
| Shopify | Caught at step 3 | The saved password was wrong here too. Shopify's security page said "You have never changed your password." After a code by email, the change went through on the first try. |
| Ticketmaster | Caught at step 6 | Every change needed a code by text. The site took the new password but the vault kept the old one, and step 6 caught it after three refused sign-ins and a warning that "only 2 more sign in attempts are allowed". The forgot-password email fixed it. |
Canva's sign-in in a private Chrome window, recorded on 13 October 2026 to show the screens I went through on 4 October. Email hidden.
The screenshots show steps 3 to 6 on Ticketmaster using Rekey, the browser extension I'm building (in beta). The seven steps are the manual version of what Rekey is built to do.
Where is change password in settings?
The change-password form usually sits under account, profile or security settings, but it's often hard to find. I found it through the site's own menus on only 4 of 28 sites. On Outlook I had to search the web for instructions, and on Spotify I got there by typing into Chrome's search bar.
Your password manager can save you the hunt. Bitwarden's help page says: "In most cases, the browser extension will take you directly to that service's change password page." 1Password's guide tells you to sign in and "find the 'change password' page" yourself. Rekey opens the site and copies a new password for you, but only goes straight to the form on sites where it has seen the form before, and a few it already knows.
Some sites also set up a standard address, /.well-known/change-password, which the W3C draft says "enables password managers to help users change their passwords on sites which support it". Not every site supports it, and some send you to the homepage.
Why is my password change not working?
A password change usually stops working because the site asks for something in the middle of it: a code, a current password it won't accept, or a new password it doesn't like. In my test, 6 of 28 sites failed on the first attempt. For example:
- Amazon Sent an email code that didn't work, then a code by text after a reload. It was the only site that rate-limited me.
- GitHub Didn't accept the new password after the change, which forced an email check, a second reset and a fingerprint prompt.
- LinkedIn Hit a password manager problem partway through, and I had to redo the change.
Why is it not letting me change my password?
The site may be rejecting the new password itself. A message like "password was recently used, choose another" means the site keeps your old passwords, so generate a fresh one. On 28 September 2026 a site refused a new password of mine because it "has appeared in a data leak", and Chrome still offered to save it. Don't save a password the site has just refused.
What to do if the verification code is not coming?
If the verification code isn't coming, check spam and give it a minute before asking for another. If it still doesn't arrive, switch to the other method if the site offers one; that's what got me through on Amazon.
Why does it keep saying login session expired?
The change page timed out before you finished, so sign in again and start over. Having your codes ready before you begin keeps you on the page.
Why does it say something went wrong when I try to change my password?
Search results for this are mostly about Google accounts, but the fix works anywhere: reload, sign in fresh, try once more, then stop.
What to do when a change half-fails
A half-failed change means the site and your vault now disagree about your password, which is how people get locked out. I've seen three versions:
- The site took the new password, but the vault didn't. I recreated this on 28 September 2026 by changing a password with each manager switched off, then letting it sign in. 1Password, Bitwarden and Proton Pass all filled the old password on TypeRacer and said nothing when the site rejected it.
- The vault took a password the site didn't. On Shopify the site rejected the current password from the vault, and I gave up after 243 seconds, 66 clicks and 25 page loads. On 4 October 2026 Shopify's security page said "You have never changed your password." So my vault (Rekey) was most likely holding a new password from a change that never went through.
- The site took the change, and the vault missed it. On Ticketmaster on 4 October 2026, Rekey most likely stopped waiting before the text code went in, so it kept the old password. The next three sign-ins were refused with the warning "only 2 more sign in attempts are allowed". I've since changed Rekey to wait for the code.
Study 1 log · Shopify · 13 August 2026
25 page loads, 243 seconds, no change. The security page came up 6 times and "verify it's you" 4 times.
- 0Store admin
- 1Personal details
- 2Security
- 3Verify it's you
- 4Security
- 5Sign in
- 6Sign in
- 7Personal details
- 8Security
- 9Verify it's you
- 10Security
- 11Sign in
- 12Sign in
- 13Personal details
- 14Signed out
- 15Store admin
- 16Store admin
- 17Sign in
- 18Sign in
- 19Passkey prompt
- 20Personal details
- 21Security
- 22Verify it's you
- 23Sign in
- 24Verify it's you
- 25Security
So when a change half-fails:
- Stop submitting. Every retry is another failed attempt on the account.
- Check which password the site holds. Try the new one in a private window, then the old one from the item's history.
- Make the vault match whichever works. Update the existing login rather than saving a second one.
- If neither works, use the forgot-password flow.
Step 5 is a workaround: you save the new password yourself.
How to change password without entering current password?
To change a password without entering the current one, use the site's forgot-password flow, which checks your email or phone instead. A normal change form usually won't let you, because it asks for the current password first, which is why step 3 comes before the change. In Study 1 only GitHub ended up in the forgot-password flow. On Cirro I had to type the current password from memory and got it wrong a few times, the slowest completed change in the study.
If the site rejects your saved password, check the item's history before you reset; you may have saved over one that still works.
What to do if you can't reset your password?
If you can't reset or change a password, note it in your password manager and go through the site instead. In my test, 6 of 28 sites (21%) couldn't be changed at all, in two ways:
| What happened | Sites | What it means for you |
|---|---|---|
| No change-password option found in the time I gave it | 4 of 28 | I spent between 35.5 and 106.7 seconds looking. On one site that was 15 page loads with no form at the end. |
| Found the form, but still couldn't change it | 2 of 28 | One site rejected the current password from the vault, most likely my own vault's mistake (see above). The other blocker wasn't recorded. |
Not finding the form means I didn't find one in that time, not that the site has none. For an account you can't change:
- Note it in the vault, with the date you tried and the fact it still has the at-risk password.
- Try the forgot-password flow. It often works when the settings page doesn't.
- Contact the site's support and ask where to change it, or ask them to reset it.
Password reset link expired
Request a new link and use only the newest email, because some sites cancel older links. Open it soon, while your inbox is still open from step 2.
How long do you have to wait after failed login attempts?
How long you wait after failed login attempts depends on the site, and most don't say. In Study 1 only 1 of 28 sites put a hold on the account: Amazon rate-limited me after an email code failed, and a code by text got me through. One site isn't enough to say how common holds are.
How long does an account lockout last?
Each site sets its own, and I didn't time Amazon's, so I can't give a number. While a hold is on, stop trying; more attempts won't end it sooner.
Key takeaways
- 6 of 28sites couldn't be changed at all. Plan for some accounts you can't fix from settings.
- 7 of 28sent me off the site for a code, and 6 asked for a code or extra password mid-change. Open your email and phone first.
- 4 of 28let me find the form through their own menus. Use your password manager's link.
- 2 of 3saved passwords were already wrong in my 4 October run. Check the saved one first.
- Step 6Test the new password in a private window before you sign out anywhere else.
- StopWhen a change half-fails, stop retrying and make the vault match the site.
How this was tested
- Study 1 (reset timing): I tested alone, on my own accounts, over one afternoon on 13 August 2026: 32 timed runs on 28 different sites. For each site I signed in as normal, started the clock and looked for the change-password form using only the site itself. A browser extension recorded the time, every click, every page load and the route taken, without ever reading what was typed into a field. New passwords were generated in a password manager and pasted in.
- What counts: "couldn't be changed" means the password wasn't changed in the time recorded, not that the site has no way to do it. When a site was tested more than once, only the first attempt counts. One of the 6 failures, Shopify, was most likely my own vault's fault rather than the site's (see the half-failed change above). The bar at the top of the page uses those first attempts: 16 sites changed on the first try, 6 changed after a failed first attempt and 6 weren't changed.
- Limits: one person in one country. I knew I was being timed and I'm technical, so a typical user would likely be slower. No phone carrier was tested, and only one bank was. This shows what happened on my accounts, not a rate for every site.
- The half-failed change: the password manager results come from a separate test I ran on 28 September 2026: 3 managers on 3 sites, 9 runs.
- The step order: I ran the seven steps on Canva, Ticketmaster and Shopify on 4 October 2026, on my own accounts, and screen-recorded them. Canva and Ticketmaster weren't in Study 1, so they have no Study 1 numbers, and the Ticketmaster account was new, made for the test. Screenshots are dated and private details are hidden. The Canva sign-in screens were recorded again on 13 October 2026, because the 4 October recordings were lost.
- Vendor quotes: 1Password's guide "Use the password generator to change and strengthen your passwords" (published 24 August 2026), Bitwarden's "Change At-Risk Passwords" and the W3C change-password URL draft. First read 29 September 2026, every quote re-checked on the live pages on 13 October 2026.
- Rekey: the extension I'm building, in beta. It was my vault in Study 1 and the tool I used for the 4 October run. Two of its bugs show up above, and I say so where they do. Study 1 measured the sites, not Rekey, but Rekey was the vault I used, and it most likely caused the Shopify failure. Nothing here is a claim about how well Rekey does.
Corrections: if a site adds a change-password page or you get a different result, open an issue on Rekey's public GitHub repo. I'll re-test and date the change here.
Rekey is a browser extension, in development. Join the early-access list and we will email you once, at launch.
Get early access- Finds every exposed login by checking your saved passwords against Have I Been Pwned
- Opens each site for you, with a strong new password ready to paste
- Keeps your previous password one click away while a change isn't confirmed yet, with an undo if the update was wrong
- Open source and zero-knowledge. Passwords are encrypted on your device, and optional sync only ever stores the encrypted copy. Read the code yourself
Free while in development. We will not sell your address or send you anything else.