A PayPal password isn't like a streaming login - It stands between the internet and your bank account, your cards, and your ability to send money in one tap. That's why PayPal credentials are among the most phished on earth, and why "your account has been limited, click here to verify" remains the most durable scam email format of the past two decades. Change your PayPal password now if it's reused anywhere else, if you've received a login alert you don't recognize, if you clicked anything sketchy recently, or if it's simply short. Here's the current path on web and mobile, plus what to do right after.
Change Your PayPal Password on the Web
- Type paypal.com into your browser yourself - Never follow an emailed link - And log in.
- Click the Settings gear icon near the top-right of the page.
- Open the Security tab.
- Find the Password row and click the option to update or change it.
- Confirm your identity if prompted (PayPal sometimes asks for a code or your current password here).
- Enter your current password, then the new one twice, and save.
Generate the replacement before you start: a random 16+ character string, or a multi-word passphrase if you occasionally need to type it on a phone keyboard. PayPal accepts long passwords, and length is the property that matters most - You can sanity-check the result with the password strength meter before committing.
Change It in the Mobile App
- Open the PayPal app and log in.
- Tap your profile icon (top corner).
- Go to the account or settings area, then open Security (labeled "Login and security" in some app versions).
- Tap Password, verify yourself with your current password or a code, and enter the new password.
- Save. The app may ask you to log in again with the new credential.
The app and web flows write to the same account, so use whichever is in front of you - There's no security difference.
If You've Forgotten Your Password
- On the login page, enter your email and click Forgot password? (the link may read "Having trouble logging in?").
- Choose a verification method - PayPal typically offers a code by email, a code by SMS to your linked phone, and sometimes confirmation of linked card details.
- Complete the check, then set a new password.
If an attacker beat you to it and changed the email or phone on file, don't keep retrying - Go to PayPal's help center and use the account-recovery contact options. Because money is involved, PayPal's support can verify you through transaction history and linked financial instruments, but expect the process to take longer than a normal reset. Speed matters here: the sooner you report, the better your odds on any disputed transactions.
For any account that can move money, the rule is simple: reach the login page by typing the address yourself. A password entered on a page you clicked to from an email may already belong to someone else.
After You Change It
- Review active sessions and devices. In the Security section, check for logged-in devices or authorized computers and remove anything unfamiliar. The reset flow generally forces re-login, but confirm.
- Turn on 2-step verification. In the same Security tab, enable two-step login and choose an authenticator app rather than SMS where offered - Codes generated on your device can't be intercepted by a SIM swap, an attack explained in our SIM swapping breakdown. You can see how these rotating codes work with the free TOTP generator. The full setup logic is in the two-factor authentication guide.
- Audit connected apps and automatic payments. Remove third-party permissions and billing agreements you don't recognize.
- Check recent activity for transactions you didn't make, and dispute any immediately.
- Update your password manager so the new credential is saved and autofill keeps steering you to the real domain - One of autofill's underrated anti-phishing benefits, covered in our phishing protection guide.
Quick comparison of the three routes:
| Route | Path | You must prove | Best for |
|---|---|---|---|
| Web change | Settings gear → Security → Password | Current password (+ possible code) | Routine rotation, known password |
| App change | Profile → Security → Password | Current password or code | Doing it from your phone |
| Forgot-password reset | Login page → Forgot password | Email/SMS code or card details | Lost or compromised password |
If the same password guarded other accounts, change those next, starting with your email - And if any of them is a shopping account with saved cards, treat it with the same urgency, as in our walkthrough for changing your Amazon password.
FAQ
Will changing my PayPal password log out other devices?
Completing a password reset generally invalidates existing sessions and forces devices to sign in again. After a routine change, take the extra minute to review the devices or sessions list in Security settings and remove anything you don't recognize, rather than assuming.
PayPal says my password is wrong but I'm sure it's right. Am I hacked?
Not necessarily - First rule out a stale saved password in your browser or manager, and check you're on paypal.com and not a lookalike domain. If the password truly stopped working and reset emails aren't arriving, an account takeover is possible; use PayPal's help center recovery options immediately.
Should I use SMS or an authenticator app for PayPal 2FA?
An authenticator app, where available. SMS codes protect against most opportunistic attacks but can be stolen via SIM-swapping, and a payment account is exactly the kind of target that justifies that effort. App-generated TOTP codes never travel over the phone network.
How strong does a PayPal password need to be?
Treat it like your email password: at least 16 characters, randomly generated, used nowhere else. There's no scenario where you benefit from a memorable-but-weak PayPal password - Your manager fills it, and the forgot-flow exists for emergencies.