Choose a new password

Route: /register/reset/validate?c=CODE&email=EMAIL
API: POST /v1/auth/password-reset/confirm
Visual reference: source/RenewCMS Screens Auth.dc.html, group "Reset password" (open it in a browser; each state is drawn at desktop and mobile, with a light/dark toggle).

Opened from the reset email. The email comes from the URL and is read-only. The confirm field is checked only in the browser.

States

Trigger: Both parameters are present.

Heading: Choose a new password
Description: "Pick something you haven't used here before. You'll log in with it next."
Field Email: placeholder "you@example.com"; value "marta@renew.example"; read-only; help "From your reset link."
Field New password: password with show/hide; checklist "At least 8 characters" (unmet)
Field Confirm new password: password with show/hide; checklist "Passwords match" (unmet)
Submit button: "Change password"

Trigger: On submit, with fewer than 8 characters.

Heading: Choose a new password
Description: "Pick something you haven't used here before. You'll log in with it next."
Field Email: placeholder "you@example.com"; value "marta@renew.example"; read-only; help "From your reset link."
Field New password: value "lime"; password with show/hide; checklist "At least 8 characters" (err)
Field Confirm new password: value "lime"; password with show/hide; checklist "Passwords match" (met)
Submit button: "Change password"

Trigger: On blur of the confirm field, or on submit.

Heading: Choose a new password
Description: "Pick something you haven't used here before. You'll log in with it next."
Field Email: placeholder "you@example.com"; value "marta@renew.example"; read-only; help "From your reset link."
Field New password: value "limewash2026"; password with show/hide; checklist "At least 8 characters" (met)
Field Confirm new password: value "limewash2025"; password with show/hide; error "The passwords don't match."; checklist "Passwords match" (err)
Submit button: "Change password"

Trigger: Request in flight.

Heading: Choose a new password
Description: "Pick something you haven't used here before. You'll log in with it next."
Field Email: placeholder "you@example.com"; value "marta@renew.example"; read-only; help "From your reset link."
Field New password: value "limewash2026"; password with show/hide; checklist "At least 8 characters" (met)
Field Confirm new password: value "limewash2026"; password with show/hide; checklist "Passwords match" (met)
Submit button: "Changing password…", loading

Trigger: 200 → /login?reason=password-changed.

Alert (success, circle-check): Password changed "Log in with your new password."
Heading: Log in
Description: "Welcome back. Log in to manage your articles."
Field Username: placeholder "Your username"
Field Password: password with show/hide; link "Forgot password?"
Submit button: "Log in"

Trigger: The code is wrong, used, or older than 1 hour.

ResultPanel (error, link-2-off): This reset link has expired; text "Reset links work once, for 1 hour. Request a new one and use it within the hour."; actions "Request a new link" (primary), "Back to log in" (secondary)

Trigger: The link has no c or no email. No request is made.

ResultPanel (error, link-2-off): This link is incomplete; text "Part of the reset link is missing. Open it from your email again, or request a new one."; actions "Request a new link" (primary)