The short answer
The mobile app is the route that actually replaces a forgotten password. Select Forgot password? on its sign-in screen, type the address on the account, and Whizi emails a 6-digit code that you enter on the next screen along with the new password. The website route is a different thing wearing the same label: Forgot password? there asks the provider for an email_link sign-in email pointed at whizi.io/reset-password, and /reset-password is a change form whose first field is Current Password. So the website side replaces a password you still know. If the website password is genuinely gone, the app route or support is the way back, not the emailed link.
There are four places the reset can start, and they do not behave the same way:
| Where you start | The control | What gets sent | Signed out first |
|---|---|---|---|
| Website sign-in page | Forgot password?, on the Password label row | An email_link sign-in email aimed at /reset-password | No |
| Website Settings, Account section | Reset Password | The same email link, to the same address | Yes, the moment you select Send Reset Link |
| Mobile app sign-in screen | Forgot password? | A 6-digit code | You are already signed out there |
| Mobile app Settings | Reset password, behind a confirmation | A 6-digit code | Yes, after you confirm |
The one to know before you use it is the second row. It signs you out of Whizi on the spot, and it does that before it checks whether you typed anything in the email field.
Whizi runs its own reset screens
Authentication is provided by Clerk, but the screens are not Clerk hosted pages. The reset dialog on the sign-in page, the change form at /reset-password, and the reset steps inside the mobile sign-in screen are all Whizi screens that call the provider underneath, so the form you type into is Whizi code rather than a provider-hosted page.
That split decides which wording you get when something fails. Every one of those surfaces prefers the provider message when there is one, and falls back to a Whizi string when there is not. So a refusal about password length or strength arrives in the provider wording, quoted as it came. The fallback differs by surface, which is the fastest way to tell in a support thread where a failure happened:
| Surface | Fallback when no readable message came back |
|---|---|
| Website reset dialogs, sign-in page and Settings | Failed to send reset email. Please try again. |
Website change form at /reset-password | Failed to reset password. Please try again. |
| Both reset steps in the mobile sign-in screen | Couldn't sign in. Please try again. |
The checks Whizi writes for itself are thin and unevenly spread. The website change form requires the current password field to be filled and the two new entries to match. The mobile reset step performs none: it has one new-password field and sends its contents as typed. The only other Whizi check anywhere in the flow is that the email field is not empty, on both website dialogs and on the app's first reset step. There is no minimum length, character rule or reuse rule written into Whizi at all. Those live at the provider and reach you through its quoted messages.
The full table of sign-in, session and reset error strings, with the trigger for each, is on when you cannot sign in. This page covers the flow, that page covers the wording.
Starting from Settings signs you out first
On the website, Settings has a Reset Password row in the Account section, next to Subscription and Cancel Subscription. It opens a dialog with an Email Address field and a Send Reset Link button.
Selecting that button signs you out of Whizi before it does anything else. The sign-out runs first, then the code checks whether the email field was filled. Submit it empty and you are signed out with nothing sent, and the only way back in is the sign-in page.
The field is also blank when the dialog opens. It is not filled in from the address on the account you are signed in to, so have the address to hand before you open it rather than after you have been signed out.
Success reads differently depending on where you started, which is a quick way to tell the two routes apart in a support thread:
| Surface | Success message |
|---|---|
| Sign-in page dialog | Check your inbox for a reset link. |
| Settings dialog | Password reset email sent successfully! |
The mobile app is built on the same sign-out-first design but tells you first. Selecting reset there raises a confirmation titled "Reset your password?" whose body says Whizi will sign you out and email a 6-digit code to the account address, naming that address in the sentence, then asks you to enter it on the next screen to set a new password. The buttons are Cancel and "Sign out and reset". It also carries your address across the sign-out, so the reset step opens already filled in. The website does neither of those things.
The mobile app sends a code, not a link
The app reset is a two-step flow on the sign-in screen and it ends with you signed in, which makes it the more predictable of the two routes.
- The first step asks for the address. Submit it empty and the screen answers
Enter the email address on your account.
- Whizi requests the code, then confirms with
We sent a 6-digit code tofollowed by the address you typed.
- The second step takes the code and the new password together. If it succeeds, the app activates the new session and drops you into Whizi. There is no separate sign-in afterwards.
One account type cannot finish there. If the account has a second verification factor, the app has no screen for it and answers: "This account needs another verification step. Contact support and we'll help you back in." That is the real instruction, not a retry prompt.
Everything else the app shares with the website, including the plan and the conversation history you come back to, is on Whizi on mobile.
Changing a password you already know
/reset-password on the website is a change form rather than a recovery form. It has three fields, Current Password, New Password and Confirm New Password, and it refuses to run without the first one: Current password is required. when it is empty, and Passwords do not match. when the last two differ.
A successful change ends every other session on the account. The form asks the provider to sign out of other sessions as part of the update, so any other browser or device holding a Whizi session is signed out by the change, not merely left alone. It is silent: nothing on the form announces it, and no message is produced by it, so the only strings this screen can show are the two validation errors, the provider's own refusal text, and the success line below. Worth knowing before you change a password on a shared machine.
On success the page shows Password reset successful! Redirecting to chat... and moves you to the chat page after a two second pause.
Typing that URL in the address bar is not a way to reach it. The route sits behind the guard that sends signed-in visitors to the chat page, and /reset-password is not one of the four paths exempt from that guard (settings, pricing, terms of service and privacy policy are). Visited while signed out it renders User not authenticated. Please log in. instead of a form. The sign-in page dialog and the Settings dialog both send the same email link to that same address, so neither is a way around the Current Password field either.
What a password reset does not fix
A new password only replaces the credential. Four things people expect it to solve, it does not:
| What you want | Does a reset do it |
|---|---|
Clear a session token error such as Invalid or expired session token. | No. That is token verification failing, covered on when you cannot sign in |
| Change the email address you sign in with | No. There is no self-serve control for the address at all. See change the email on your account |
| Restore free messages you have used | No. The free tier allowance is 7 messages for the life of the account, with no reset path |
| Move a subscription onto a different account | No. The plan follows the account, not the password |
If the account address itself is one you can no longer read, the reset route is gone with it, because both the link and the code arrive in that inbox. Raise that with support while the old inbox still works rather than after.
- Forgot password? sits on the Password label row of the website sign-in page and opens a Reset password dialog
- In the app it is a right-aligned link below the email and password fields, which carry placeholders and no labels
- The website emails a sign-in link aimed at /reset-password, the mobile app emails a 6-digit code
- Settings, Reset Password signs you out before it sends, and before it checks the email field is filled
- The website reset field is never prefilled, so have the account address ready
- The mobile app warns first, prefills the address, and signs you in when the reset completes
- The website change form checks the current password field is filled and the new entries match, the mobile reset step validates nothing at all, and every length or strength rule comes from the auth provider
- Changing a password you know signs out every other session on the account
- A reset does not clear session token errors, change your email address, or return used free messages
Frequently asked questions
Where is Forgot password on Whizi?
On the website it sits on the sign-in screen, on the same row as the Password label and to the right of it, and opens a dialog titled Reset password with a single Email field and a Send reset link button. The mobile app places it differently: the sign-in fields there carry placeholders and no labels at all, so Forgot password? is a right-aligned link on its own row below the email and password fields. You do not need to be signed in on either, and there is no separate recovery URL to find.
Does being signed out by the Settings reset mean it failed?
No. The sign-out is the first thing that route does, before the email is even attempted, so it happens whether the send succeeds or not. Password reset email sent successfully! in the dialog is the confirmation that it did. If that line never appears, sign back in from the sign-in page and start the reset there instead.
Does resetting my password sign me out on my other devices?
Yes, when you change it from the change form at /reset-password. That update asks the authentication provider to sign out of other sessions as part of the change, so other browsers and devices holding a Whizi session lose it. Nothing warns you first and nothing reports it afterwards, so check what else is signed in before you change a password rather than after.
I sign in with Google. What password am I resetting?
Whizi does not branch on how the account was created: the reset dialog takes an email address, asks the provider to send the reset, and shows whatever the provider answers word for word. If Continue with Google has always been your way in, that button is on the sign-in page and needs no password at all, which is the faster route back. If the provider refuses the reset, the message it returns is the accurate explanation and is worth quoting to support verbatim.
Does a password reset give me my free messages back?
No. The free tier allowance is 7 messages counted for the life of the account, with no reset path, so nothing about credentials touches it. What the app says when you reach the end of it is on out of credits, and the paid allowances are on plans and limits.