Password Reset

Getting a New Password

Nobody chooses their own DigitVA password: every password is made for you by the server, and you never type a new one in. Your password is three short words and a number, for example river-mango-lamp-4821.

Forgot Your Password

  1. Go to the login page and click "Forgot Password".
  2. Enter your email address or mobile number and click "Send Reset Link".
  3. If your account has a verified email, DigitVA sends a reset link to it. Check your inbox (and spam folder).
  4. Open the link and press "Email me a new password". DigitVA emails you a new password; the page itself never shows it.
  5. Sign in with the new password. Your old password stops working and every signed-in session ends.

Typing your email or number never changes your password by itself: only opening the link and pressing the button does. The confirmation message is the same whether or not the account exists.

Signing in with a mobile number only? Ask your data manager for a sign-in code, then use "I have a code" on the sign-in page. Your new password is shown to you once.

Reset Link Expiry

Reset links expire after 1 hour and work once. If your link has expired, request a new one.

Rate Limiting

LimitScopeApplies To
3 requests per hourPer IP addressForgot password
5 requests per minutePer IP addressPressing the button on a reset link

Breach Check (HIBP)

Every generated password is checked against the Have I Been Pwned breach database (only the first 5 characters of its SHA-1 hash leave DigitVA) and redrawn if it appears there. If the breach service cannot be reached, nothing changes and you see "Password breach check is temporarily unavailable. Please try again."

First-Time Users

When your account is created you receive a verification email. Open its link and press "Verify my email": DigitVA then emails you your password. See Email Verification.