TravelFlow checks every new password against a set of rules, locks accounts after repeated failed sign-ins, and lets a super admin force a password change. This article covers what makes a valid password, how to change it, what happens if you get locked out, and how to reset a password you have forgotten.
Password Requirements
Four rules apply everywhere you set a password:
- At least 8 characters long.
- Contains at least one uppercase letter (A-Z).
- Contains at least one lowercase letter (a-z).
- Contains at least one number (0-9).
A fifth rule — at least one special character such as !, @, #, $, % or & — is controlled by the Require Special Characters in Passwords setting and is on by default. It is applied when you register a new account yourself and when an admin creates an account for you. It is not applied by the two in-app password change screens, which only check the four rules above. The same difference applies to the Min Password Length setting: registration honours whatever value a super admin has set, while the change screens always use 8.
Changing Your Password
To change your password at any time:
- Open
My Profile > Security. The Change Password form is already on the tab — there is no button to reveal it. - Enter your Current Password. This is used to re-authenticate you, so it must be correct.
- Enter your New Password. A four-item checklist appears under the field and turns each item green as you satisfy it.
- Retype it in Confirm New Password. A mismatch is flagged immediately.
- Click Update Password. You see Password changed successfully, the form clears, and you stay signed in on this device.
If a rule is not met, the form stops and shows a single message in red at the top of the tab, such as Password must contain at least one number. A wrong current password produces an authentication error from Firebase instead.
Forced Password Change
Accounts created by an admin — individually, through bulk import, or as part of a new organization — are issued a temporary password and flagged Require password change on next login. An admin can also set that flag on an existing account from the user edit screen.
When the flag is set, signing in takes you to a full-page Change Your Password screen instead of your dashboard. Enter the temporary password, then a new one twice. This screen adds a colour-coded strength meter (Weak, Fair, Good, Strong) above the same four-item checklist, and it rejects a new password that is identical to the temporary one with New password must be different from current password. Click Change Password to finish; you are then sent to your dashboard.
Password Expiry
A super admin sets Password Expiry (days) in the Password Policy card on Settings > General Settings (90 days by default). The age of your password is measured from the last time it was changed. If no change date is recorded on your account, your password is not treated as expired; the date is recorded the next time you sign in.
Once that many days have passed, signing in shows the warning Your password has expired. Please set a new password. and takes you to the Change Password screen, which returns you to the page you asked for once the new password is saved. There is no advance notice before the date. Until you set a new password, TravelFlow refuses everything else you try to do, even if you leave the screen.
Account Lockout
Failed sign-in attempts are counted per email address and network, so failures from somewhere else never lock you out of your own connection. Until a super admin saves other values in the Login Security settings, 5 failed attempts within 60 minutes from one network lock sign-in from that network for 15 minutes, and every save of those settings is recorded in the audit log. While the account is locked, further attempts are refused before the password is even checked, with the message Account is temporarily locked. Please try again in N minute(s). When the wait left is not stated, the message is Account is temporarily locked. Please try again later. A successful sign-in clears that network’s counter. If you cannot wait out the lockout, your administrator can unlock your sign-in from their Security page, or a super admin can see the locked accounts and unlock yours from the Login Security card on Settings > General Settings.
Forgotten Password
If you cannot remember your password:
- Click Forgot password? under the password field on the login page.
- On the Forgot Password? page, enter your email address and click Send Reset Instructions.
- You always land on a Check Your Email confirmation, whether or not an account exists for that address — that is deliberate, so the page cannot be used to find out who has an account.
- Open the reset email and follow its link to set a new password. TravelFlow sends the email, and its link opens TravelFlow's own Choose a New Password page, works once and expires after an hour.