By default, the "Forgot Password" module is not turned on in v2.1. My thought was that lack of such a function is technically more secure (on any site or CMS). Why? Because having such a function active means your password is only as secure as your email (*though see note at end of this message). So I thought we'd start things out as secure as possible and let people adjust it according to their own need. But I'm rethinking that decision, and may change it to be 'on' by default.
If you don't already have that "Forgot Password" module installed, it is relatively easy to reset your password with the API. Lets say that you lost the password for your account named 'admin' and you wanted to reset it. Paste this code into any one of your templates (like /site/templates/home.php in the default profile, for example):
<?php
$admin = $users->get('admin');
$admin->setOutputFormatting(false);
$admin->pass = 'yo12345'; // put in your new password
$admin->save();
…or if it's easier for you to copy/paste everything on one line, here's the same thing as above on one line:
<?php $users->get("admin")->setOutputFormatting(false)->set('pass', 'yo12345')->save();
Replace "yo12345" with the new password you want and save the template. Then view a page using that template (like the homepage, in our example). The password for that account has now been reset, and now you are ready to login.
Don't forgot to now remove that snippet of code from the template! Otherwise your password will get reset every time the page is viewed.
Once logged in, here's how to install the Forgot Password capability:
1. Click to the "Modules" tab.
2. Scroll down to the "Process" modules.
3. Click "Install" for the "Forgot Password" module.
That's all there is to it. You will now see a "Forgot Password" link on your login page.
*ProcessWire's "Forgot Password" function is actually a little more secure than what you see in most other CMSs. Not only do you have to have the confidential link in the email, but the link expires in a matter of minutes, and PW will only accept password changes from the browser session that initiated the request. So an attacker would have to initiate the password change request and have access to your email at the same time, making it a lot harder for a man-in-the-middle snooping on your email.