---
title: Configuring password resets for Xperience administration
related:
  - https://docs.kentico.com/13/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/setting-the-user-password-format.md
  - https://docs.kentico.com/13/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/implementing-password-reset-for-the-live-site.md
  - https://docs.kentico.com/13/configuring-xperience/managing-email-templates.md
  - https://docs.kentico.com/13/macro-expressions.md
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

If editors or other administration interface users forget their password, they may reset it, provided they have access to the email address specified for their account.

> **Note:** **Note**
>
> Resetting of passwords is not possible for external users (for example Active Directory users created using [Mixed-mode Windows authentication](https://docs.kentico.com/13/managing-users/user-registration-and-authentication/configuring-windows-ad-authentication/configuring-mixed-mode-authentication.md)).

When submitting a password reset request, users must type in their **email address**. The request affects only the user account with the corresponding email address. If the entered email address does not correspond to any registered user, the system does not send the email.

Password recovery emails are sent from the address specified in the **Send password emails from** setting in **Settings -> Security & Membership -> Passwords**.

The sign in page of the administration interface, contains a **Forgotten password** link default. You can hide the link by adding the following key to the **/configuration/appSettings** section of the Xperience administration project's (CMSApp) **web.config** file:

```html

<add key="CMSShowForgottenPassLink" value="false" />

```

## Password reset functionality

Password reset requires email approval from the affected user. Users who submit a password recovery request through the sign-in form first receive an email containing a link.

The main security benefits of this approach are:

- Passwords are not directly included in the email, so they cannot be read by potential attackers.
- The reset links are only valid temporarily. The time period during which the links are valid can be specified in hours via the **Reset password interval** setting.
- After someone uses a password reset link, it becomes invalid and cannot be accessed again.

> **Info:** **Note**: Certain types of web filtering software may interfere with password reset links. If an automatic tool accesses the password reset page before it is opened by the actual user's client, the password recovery request will be invalid.

When users click the link in the email, they are redirected to the **\~/CMSModules/Membership/CMSPages/ResetPassword.aspx** system page, where they can set a new password. The URL of the link contains a token in its query string that automatically identifies the user whose password should be changed.

> **Info:** **Recovering administrator password**
>
> If you happen to lose the password for your administrator account and cannot access the administration interface, you can use one of the following approaches to recover it:
>
> - **Reset password via a web.config key** – insert the **CMSAdminEmergencyReset** key to the **appSettings** section of your web.config. For example:
>
>   ```html
>
>   <add key="CMSAdminEmergencyReset" value="admin;password;true" />
>
>   ```
>
>   - _admin_ – this value specifies the user name of the new account.
>   - _password_ – this value specifies the password for the new account – you should change it to your own value.
>   - The third parameter is optional and indicates whether you want to create a new user with the Global administrator [privilege level](https://docs.kentico.com/13/managing-users/user-management.md).
>   - The key will be automatically deleted after you gain access to the user interface.
> - **Clear password in the database** – find your user record in the **CMS\_User** table and clear the contents of the **UserPassword** column. Then sign in to the administration interface with a blank password and set a new password.

## Password recovery email templates

The emails sent to users during the password retrieval process are based on [email templates](https://docs.kentico.com/13/configuring-xperience/managing-email-templates.md), which can be found in the **Email templates** application. The following password‑related templates are available:

- **Membership - Change password request**– sent as a reply to password recovery requests.
- **Membership - Password reset confirmation** – sent to the user upon a successful password reset. Also sent when an administrator manually sets a new password for a user.
- **Membership - Changed password** – sent to users if a new password is generated for their account by an administrator.

These templates can be edited as needed, so you may fully customize the content of the emails. You can enter context macros to include dynamic values in the template text:

| Template                    | Context-specific macros                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Change password request     | **{% ResetPasswordURL %}** – resolves into the URL of the page where the user can change their password.<br>**{% CancelURL %}** – returns the URL of a page that will cancel the request when opened. This can be used to create links that users can click in situations where someone else requested a new password for their user account (either intentionally or accidentally).<br>**{% User %}** – allows you to access the properties of the user who sent the change password request, for example: _{% User.UserName %}_<br>**{% IP %}**_–_ returns the IP address of the device the change password request was issued from. This can be used to notify users of the origin of unwanted password reset requests. |
| Password reset confirmation | Common user properties, such as **{% UserName %}**, **{% FirstName %}**, **{% Email %}**, etc.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Changed password            | **{% Password %}** – the current (new) password of the given user.<br>Common user properties, such as **{% UserName %}**, **{% FirstName %}**, **{% Email %}**, etc.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |

In addition to the special macros listed above, you can also use all other standard macro expressions in the templates. See the [Macro expressions](https://docs.kentico.com/13/macro-expressions.md) chapter for more information about macro expressions in Xperience.