Manage passwords

Amplify Auth provides a secure way for your users to change their password or recover a forgotten password.

Understand password default settings

By default, your users can retrieve access to their accounts if they forgot their password by using either their phone or email. The following are the default account recovery methods used when either phone or email are used as login options.

Login option	User account verification channel
`phone`	Phone Number
`email`	Email
`email` and `phone`	Email

Reset Password

To reset a user's password, use the resetPassword API which will send a reset code to the destination (e.g. email or SMS) based on the user's settings.

Amplify.Auth.resetPassword(
   "username",
   result -> Log.i("AuthQuickstart", result.toString()),
   error -> Log.e("AuthQuickstart", error.toString())

Amplify.Auth.resetPassword("username",
    { Log.i("AuthQuickstart", "Password reset OK: $it") },
    { Log.e("AuthQuickstart", "Password reset failed", it) }

    val result = Amplify.Auth.resetPassword("username")
    Log.i("AuthQuickstart", "Password reset OK: $result")
} catch (error: AuthException) {
    Log.e("AuthQuickstart", "Password reset failed", error)

RxAmplify.Auth.resetPassword("username")
    .subscribe(
        result -> Log.i("AuthQuickstart", result.toString()),
        error -> Log.e("AuthQuickstart", error.toString())

To complete the password reset process, invoke the confirmResetPassword API with the code your user received and the new password they want to set.

Amplify.Auth.confirmResetPassword(
   "Username",
   "NewPassword123",
   "confirmation code you received",
   () -> Log.i("AuthQuickstart", "New password confirmed"),
   error -> Log.e("AuthQuickstart", error.toString())

Amplify.Auth.confirmResetPassword("Username", "NewPassword123", "confirmation code",
   { Log.i("AuthQuickstart", "New password confirmed") },
   { Log.e("AuthQuickstart", "Failed to confirm password reset", it) }

    Amplify.Auth.confirmResetPassword("Username", "NewPassword123", "code you received")
    Log.i("AuthQuickstart", "New password confirmed")
} catch (error: AuthException) {
    Log.e("AuthQuickstart", "Failed to confirm password reset", error)

RxAmplify.Auth.confirmResetPassword("Username","NewPassword123", "confirmation code")
    .subscribe(
        () -> Log.i("AuthQuickstart", "New password confirmed"),
        error -> Log.e("AuthQuickstart", error.toString())

Update password

You can update a signed in user's password using the updatePassword API.

Amplify.Auth.updatePassword(
    "existingPassword",
    "newPassword",
    () -> Log.i("AuthQuickstart", "Updated password successfully"),
    error -> Log.e("AuthQuickstart", error.toString())

Amplify.Auth.updatePassword("existingPassword", "newPassword",
    { Log.i("AuthQuickstart", "Updated password successfully") },
    { Log.e("AuthQuickstart", "Password update failed", it) }

    Amplify.Auth.updatePassword("existingPassword", "newPassword")
    Log.i("AuthQuickstart", "Updated password successfully")
} catch (error: AuthException) {
    Log.e("AuthQuickstart", "Password update failed", error)

RxAmplify.Auth.updatePassword("existingPassword", "newPassword")
    .subscribe(
        () -> Log.i("AuthQuickstart", "Updated password successfully"),
        error -> Log.e("AuthQuickstart", error.toString())

Override default user account verification channel

You can always change the channel used by your authentication resources by overriding the following setting.

amplify/auth/resource.ts
import { defineAuth } from '@aws-amplify/backend';
export const auth = defineAuth({
  loginWith: {
    email: true
  accountRecovery: 'EMAIL_ONLY'

Override default password policy

By default your password policy is set to the following:

MinLength: 8 characters
requireLowercase: true
requireUppercase: true
requireNumbers: true
requireSymbols: true
tempPasswordValidity: 3 days

You can customize the password format acceptable by your auth resource by modifying the underlying cfnUserPool resource:

amplify/backend.ts
import { defineBackend } from '@aws-amplify/backend';
import { auth } from './auth/resource';
const backend = defineBackend({
// extract L1 CfnUserPool resources
const { cfnUserPool } = backend.auth.resources.cfnResources;
// modify cfnUserPool policies directly
cfnUserPool.policies = {
  passwordPolicy: {
    minimumLength: 32,
    requireLowercase: true,
    requireNumbers: true,
    requireSymbols: true,
    requireUppercase: true,
    temporaryPasswordValidityDays: 20,

With admin actions

Manage WebAuthn credentials