Passwords and account recovery
The password policy for your app's users, how forgotten passwords are reset, and how you set your own password on an app.
Last updated September 17, 2026
On this page
The policy
A password for your app must be at least 12 characters and include a lowercase letter, an uppercase letter and a number. The register and reset pages state the rules and check them before submitting, so nobody discovers them from an error.
Forgotten passwords
The Forgot password page takes an email address and always shows the same message, so it never reveals whether an address has an account.
If the address has an account, a reset link is sent from your app's own sender.
The link opens the reset page, which collects a new password and signs them in.
The wording of the reset email is yours to change; see Sending email from your app.
Your own password
You are signed in to your app automatically in the builder preview. On the published app you can sign in with Google, or set a password for your own account under Users (your row offers Set my password or Change my password).
Sessions
Sessions belong to one app and expire on their own. Signing out in the app ends the session immediately. Disabling an account under Users stops it signing in again.