Both live on the Security page.
Password
Enter your current password and the new one twice in the Change password card. The change is immediate and goes in the security log. Other devices stay signed in; use Log out everywhere if you want them out too. See Sessions and the security log.
Passwords must meet the same rules as at sign-up, so a very short one is refused.
Account email
Your account email is where invoices, renewal notices, monitoring alerts and sign-in codes go, so changing it is done carefully:
- In the Account email card, enter the new address and your password.
- A confirmation link goes to the new address, and a heads-up goes to the old one.
- Click the link from the new inbox while signed in. Only then does the address change.
Nothing changes until that click, so a mistyped address cannot lock you out. The link only works for the account that requested it; a forwarded link cannot move someone else's account.
Forgotten password
Use Forgot password on the sign-in page. A reset link goes to the account email and expires after a short time. If two-factor is on, you will still need the app code after resetting.