diff --git a/.env.example b/.env.example
index c27b9b06..4bd17f0a 100644
--- a/.env.example
+++ b/.env.example
@@ -24,3 +24,20 @@ FEISHU_REDIRECT_URI=http://localhost:3000/auth/feishu/callback
 # Jina AI API key (for jina_search and jina_read tools — get one at https://jina.ai)
 # Without a key, the tools still work but with lower rate limits
 JINA_API_KEY=
+
+# Public app URL used in user-facing links, such as password reset emails.
+# Production must use your real public HTTPS domain (not localhost).
+PUBLIC_BASE_URL=http://localhost:3008
+
+# System email delivery (used for forgot-password and optional broadcast emails)
+SYSTEM_EMAIL_FROM_ADDRESS=
+SYSTEM_EMAIL_FROM_NAME=Clawith
+SYSTEM_SMTP_HOST=
+SYSTEM_SMTP_PORT=465
+SYSTEM_SMTP_USERNAME=
+SYSTEM_SMTP_PASSWORD=
+SYSTEM_SMTP_SSL=true
+SYSTEM_SMTP_TIMEOUT_SECONDS=15
+
+# Password reset token lifetime in minutes
+PASSWORD_RESET_TOKEN_EXPIRE_MINUTES=30
diff --git a/README.md b/README.md
index d55a3b86..b2436faf 100644
--- a/README.md
+++ b/README.md
@@ -156,6 +156,39 @@ Agent workspace files (soul.md, memory, skills, workspace files) are stored in `
 
 The first user to register automatically becomes the **platform admin**. Open the app, click "Register", and create your account.
 
+### System Email and Password Reset
+
+Clawith can send platform-owned emails for password reset and optional broadcast delivery. Configure SMTP in `.env`:
+
+```bash
+PUBLIC_BASE_URL=http://localhost:3008
+SYSTEM_EMAIL_FROM_ADDRESS=bot@example.com
+SYSTEM_EMAIL_FROM_NAME=Clawith
+SYSTEM_SMTP_HOST=smtp.example.com
+SYSTEM_SMTP_PORT=465
+SYSTEM_SMTP_USERNAME=bot@example.com
+SYSTEM_SMTP_PASSWORD=your-app-password
+SYSTEM_SMTP_SSL=true
+SYSTEM_SMTP_TIMEOUT_SECONDS=15
+PASSWORD_RESET_TOKEN_EXPIRE_MINUTES=30
+```
+
+`PUBLIC_BASE_URL` must point to the user-facing frontend because reset links are generated as `/reset-password?token=...`.
+In production, set it to your public HTTPS domain (for example `https://app.example.com`), not a localhost address.
+
+Quick local validation:
+
+```bash
+cd backend && .venv/bin/python -m pytest tests/test_password_reset_and_notifications.py
+cd frontend && npm run build
+```
+
+Manual flow:
+1. Open `http://localhost:3008/login`
+2. Click `Forgot password?`
+3. Submit a registered email
+4. Open the emailed reset link and set a new password
+
 ### Network Troubleshooting
 
 If `git clone` is slow or times out:
diff --git a/backend/app/api/auth.py b/backend/app/api/auth.py
index 5f4eb991..b726d9e9 100644
--- a/backend/app/api/auth.py
+++ b/backend/app/api/auth.py
@@ -1,8 +1,8 @@
 """Authentication API routes."""
 
-import uuid
+from datetime import datetime, timezone
 
-from fastapi import APIRouter, Depends, HTTPException, Query, status
+from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException,Query, status
 from loguru import logger
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -11,6 +11,8 @@
 from app.database import get_db
 from app.models.user import User
 from app.schemas.schemas import (
+    ForgotPasswordRequest,
+    ResetPasswordRequest,
     IdentityBindRequest,
     IdentityUnbindRequest,
     OAuthAuthorizeResponse,
@@ -255,6 +257,79 @@ async def login(data: UserLogin, db: AsyncSession = Depends(get_db)):
     )
 
 
+@router.post("/forgot-password")
+async def forgot_password(
+    data: ForgotPasswordRequest,
+    background_tasks: BackgroundTasks,
+    db: AsyncSession = Depends(get_db),
+):
+    """Request a password reset link without revealing account existence."""
+    from app.config import get_settings
+    settings = get_settings()
+
+    if not settings.SYSTEM_SMTP_HOST or not settings.SYSTEM_EMAIL_FROM_ADDRESS:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Password reset is currently unavailable (no mail server configured)."
+        )
+
+    generic_response = {
+        "ok": True,
+        "message": "If an account with that email exists, a password reset email has been sent.",
+    }
+
+    result = await db.execute(select(User).where(User.email == data.email))
+    user = result.scalar_one_or_none()
+    if not user or not user.is_active:
+        return generic_response
+
+    try:
+        from app.services.password_reset_service import build_password_reset_url, create_password_reset_token
+        from app.services.system_email_service import (
+            get_system_email_config,
+            run_background_email_job,
+            send_password_reset_email,
+        )
+
+        get_system_email_config()
+        raw_token, expires_at = await create_password_reset_token(user.id)
+
+        reset_url = await build_password_reset_url(db, raw_token)
+        expiry_minutes = int((expires_at - datetime.now(timezone.utc)).total_seconds() // 60)
+        background_tasks.add_task(
+            run_background_email_job,
+            send_password_reset_email,
+            user.email,
+            user.display_name or user.username,
+            reset_url,
+            expiry_minutes,
+        )
+    except Exception as exc:
+        logger.warning(f"Failed to process password reset email for {data.email}: {exc}")
+
+    return generic_response
+
+
+@router.post("/reset-password")
+async def reset_password(data: ResetPasswordRequest, db: AsyncSession = Depends(get_db)):
+    """Reset a password using a valid single-use token."""
+    from app.services.password_reset_service import consume_password_reset_token
+
+    token = await consume_password_reset_token(data.token)
+    if not token:
+        raise HTTPException(status_code=400, detail="Invalid or expired reset token")
+
+    user_id = token["user_id"]
+    result = await db.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+    if not user or not user.is_active:
+        raise HTTPException(status_code=400, detail="Invalid or expired reset token")
+
+    user.password_hash = hash_password(data.new_password)
+    await db.flush()
+    return {"ok": True}
+
+
 @router.get("/me", response_model=UserOut)
 async def get_me(current_user: User = Depends(get_current_user)):
     """Get current user profile."""
diff --git a/backend/app/api/notification.py b/backend/app/api/notification.py
index 6e1828b8..81cd47a5 100644
--- a/backend/app/api/notification.py
+++ b/backend/app/api/notification.py
@@ -3,7 +3,7 @@
 import uuid
 from typing import Optional
 
-from fastapi import APIRouter, Depends, HTTPException, Query
+from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException, Query
 from pydantic import BaseModel, Field
 from sqlalchemy import select, func, update
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -116,11 +116,13 @@ async def mark_all_read(
 class BroadcastRequest(BaseModel):
     title: str = Field(..., max_length=200)
     body: str = Field("", max_length=1000)
+    send_email: bool = False
 
 
 @router.post("/notifications/broadcast")
 async def broadcast_notification(
     req: BroadcastRequest,
+    background_tasks: BackgroundTasks,
     current_user: User = Depends(get_current_user),
     db: AsyncSession = Depends(get_db),
 ):
@@ -138,12 +140,23 @@ async def broadcast_notification(
     sender_name = current_user.display_name or current_user.username or "Admin"
     count_users = 0
     count_agents = 0
+    count_emails = 0
+    email_recipients = []
+
+    if req.send_email:
+        from app.services.system_email_service import get_system_email_config
+
+        try:
+            get_system_email_config()
+        except Exception as exc:
+            raise HTTPException(400, f"System email is not configured: {exc}")
 
     # Notify all users in tenant
     users_result = await db.execute(
         select(User).where(User.tenant_id == tenant_id, User.id != current_user.id)
     )
-    for user in users_result.scalars().all():
+    users = users_result.scalars().all()
+    for user in users:
         await send_notification(
             db, user_id=user.id,
             type="broadcast",
@@ -167,6 +180,36 @@ async def broadcast_notification(
         )
         count_agents += 1
 
-    await db.commit()
-    return {"ok": True, "users_notified": count_users, "agents_notified": count_agents}
+    if req.send_email:
+        from app.services.system_email_service import (
+            BroadcastEmailRecipient,
+            deliver_broadcast_emails,
+            run_background_email_job,
+        )
+
+        for user in users:
+            if not user.email:
+                continue
+            email_recipients.append(
+                BroadcastEmailRecipient(
+                    email=user.email,
+                    subject=req.title,
+                    body=(
+                        f"{req.body}\n\n"
+                        f"Sent by: {sender_name}"
+                        if req.body.strip()
+                        else f"Sent by: {sender_name}"
+                    ),
+                ),
+            )
+            count_emails += 1
 
+    await db.commit()
+    if email_recipients:
+        background_tasks.add_task(run_background_email_job, deliver_broadcast_emails, email_recipients)
+    return {
+        "ok": True,
+        "users_notified": count_users,
+        "agents_notified": count_agents,
+        "emails_sent": count_emails,
+    }
diff --git a/backend/app/config.py b/backend/app/config.py
index 1f23fb1d..9fd42d70 100644
--- a/backend/app/config.py
+++ b/backend/app/config.py
@@ -64,11 +64,22 @@ class Settings(BaseSettings):
     JWT_SECRET_KEY: str = "change-me-jwt-secret"
     JWT_ALGORITHM: str = "HS256"
     JWT_ACCESS_TOKEN_EXPIRE_MINUTES: int = 60 * 24  # 24 hours
+    PASSWORD_RESET_TOKEN_EXPIRE_MINUTES: int = 60
 
     # File Storage
     AGENT_DATA_DIR: str = _default_agent_data_dir()
     AGENT_TEMPLATE_DIR: str = "/app/agent_template"
 
+    # System email (platform-owned outbound mail)
+    SYSTEM_EMAIL_FROM_ADDRESS: str = ""
+    SYSTEM_EMAIL_FROM_NAME: str = "Clawith"
+    SYSTEM_SMTP_HOST: str = ""
+    SYSTEM_SMTP_PORT: int = 465
+    SYSTEM_SMTP_USERNAME: str = ""
+    SYSTEM_SMTP_PASSWORD: str = ""
+    SYSTEM_SMTP_SSL: bool = True
+    SYSTEM_SMTP_TIMEOUT_SECONDS: int = 15
+
     # Docker (for Agent containers)
     DOCKER_NETWORK: str = "clawith_network"
     OPENCLAW_IMAGE: str = "openclaw:local"
@@ -78,6 +89,7 @@ class Settings(BaseSettings):
     FEISHU_APP_ID: str = ""
     FEISHU_APP_SECRET: str = ""
     FEISHU_REDIRECT_URI: str = ""
+    PUBLIC_BASE_URL: str = ""
 
     # CORS
     CORS_ORIGINS: list[str] = ["http://localhost:3000", "http://localhost:5173"]
diff --git a/backend/app/main.py b/backend/app/main.py
index 83c46dba..30549859 100644
--- a/backend/app/main.py
+++ b/backend/app/main.py
@@ -98,6 +98,7 @@ async def lifespan(app: FastAPI):
         import app.models.trigger        # noqa
         import app.models.notification   # noqa
         import app.models.gateway_message # noqa
+        import app.models.password_reset_token  # noqa
         import app.models.identity       # noqa
         async with engine.begin() as conn:
             await conn.run_sync(Base.metadata.create_all)
diff --git a/backend/app/schemas/schemas.py b/backend/app/schemas/schemas.py
index e02e9aff..6f319a38 100644
--- a/backend/app/schemas/schemas.py
+++ b/backend/app/schemas/schemas.py
@@ -25,6 +25,15 @@ class UserLogin(BaseModel):
     tenant_id: uuid.UUID | None = None  # Optional: when set, restrict login to users of this tenant
 
 
+class ForgotPasswordRequest(BaseModel):
+    email: EmailStr
+
+
+class ResetPasswordRequest(BaseModel):
+    token: str = Field(min_length=20, max_length=512)
+    new_password: str = Field(min_length=6, max_length=128)
+
+
 class TokenResponse(BaseModel):
     access_token: str
     token_type: str = "bearer"
diff --git a/backend/app/services/password_reset_service.py b/backend/app/services/password_reset_service.py
new file mode 100644
index 00000000..83bdb378
--- /dev/null
+++ b/backend/app/services/password_reset_service.py
@@ -0,0 +1,99 @@
+"""Password reset token lifecycle helpers."""
+
+from __future__ import annotations
+
+import hashlib
+import secrets
+import uuid
+from datetime import datetime, timedelta, timezone
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.config import get_settings
+from app.core.events import get_redis
+from app.models.system_settings import SystemSetting
+
+# Key prefixes for Redis
+TOKEN_PREFIX = "pwd_reset:token:"
+USER_PREFIX = "pwd_reset:user:"
+
+
+def _hash_token(token: str) -> str:
+    """Hash a raw reset token before persistence or lookup."""
+    return hashlib.sha256(token.encode("utf-8")).hexdigest()
+
+
+async def create_password_reset_token(user_id: uuid.UUID) -> tuple[str, datetime]:
+    """Create a new single-use token and invalidate older unused tokens in Redis."""
+    redis = await get_redis()
+    user_key = f"{USER_PREFIX}{user_id}"
+    
+    # Invalidate previous token for this user if exists
+    old_token_hash = await redis.get(user_key)
+    if old_token_hash:
+        await redis.delete(f"{TOKEN_PREFIX}{old_token_hash}")
+
+    raw_token = secrets.token_urlsafe(32)
+    token_hash = _hash_token(raw_token)
+    
+    now = datetime.now(timezone.utc)
+    expiry_minutes = get_settings().PASSWORD_RESET_TOKEN_EXPIRE_MINUTES
+    expires_at = now + timedelta(minutes=expiry_minutes)
+    
+    # Store the new token (bi-directional mapping for easy invalidation)
+    token_key = f"{TOKEN_PREFIX}{token_hash}"
+    ttl_seconds = int(expiry_minutes * 60)
+    
+    async with redis.pipeline(transaction=True) as pipe:
+        pipe.setex(token_key, ttl_seconds, str(user_id))
+        pipe.setex(user_key, ttl_seconds, token_hash)
+        await pipe.execute()
+        
+    return raw_token, expires_at
+
+
+async def get_public_base_url(db: AsyncSession) -> str:
+    """Resolve the public base URL used for user-facing links."""
+    result = await db.execute(select(SystemSetting).where(SystemSetting.key == "platform"))
+    setting = result.scalar_one_or_none()
+    if setting and setting.value and setting.value.get("public_base_url"):
+        return str(setting.value["public_base_url"]).strip().rstrip("/")
+
+    env_value = getattr(get_settings(), "PUBLIC_BASE_URL", "") if hasattr(get_settings(), "PUBLIC_BASE_URL") else ""
+    env_value = str(env_value).strip().rstrip("/")
+    if env_value:
+        return env_value
+
+    raise RuntimeError(
+        "Public base URL is not configured. Set platform public_base_url or PUBLIC_BASE_URL "
+        "(required in production for reset links)."
+    )
+
+
+async def build_password_reset_url(db: AsyncSession, raw_token: str) -> str:
+    """Build the user-facing reset URL."""
+    base_url = await get_public_base_url(db)
+    return f"{base_url}/reset-password?token={raw_token}"
+
+
+async def consume_password_reset_token(raw_token: str) -> dict | None:
+    """Load a valid reset token from Redis and mark it used (by deleting)."""
+    redis = await get_redis()
+    token_hash = _hash_token(raw_token)
+    token_key = f"{TOKEN_PREFIX}{token_hash}"
+    
+    user_id_str = await redis.get(token_key)
+    if not user_id_str:
+        return None
+        
+    user_id = uuid.UUID(user_id_str)
+    user_key = f"{USER_PREFIX}{user_id}"
+    
+    # Atomic delete to ensure single-use
+    async with redis.pipeline(transaction=True) as pipe:
+        pipe.delete(token_key)
+        pipe.delete(user_key)
+        await pipe.execute()
+    
+    return {"user_id": user_id}
diff --git a/backend/app/services/system_email_service.py b/backend/app/services/system_email_service.py
new file mode 100644
index 00000000..a0f3573d
--- /dev/null
+++ b/backend/app/services/system_email_service.py
@@ -0,0 +1,159 @@
+"""System-owned outbound email service."""
+
+from __future__ import annotations
+
+import asyncio
+import inspect
+import logging
+import smtplib
+import ssl
+from collections.abc import Iterable
+from dataclasses import dataclass
+from datetime import datetime
+from email.mime.multipart import MIMEMultipart
+from email.mime.text import MIMEText
+from email.utils import formataddr, make_msgid
+
+from app.config import get_settings
+from app.services.email_service import _force_ipv4
+
+logger = logging.getLogger(__name__)
+
+
+class SystemEmailConfigError(RuntimeError):
+    """Raised when system email configuration is missing or invalid."""
+
+
+@dataclass(slots=True)
+class SystemEmailConfig:
+    """Resolved system email configuration."""
+
+    from_address: str
+    from_name: str
+    smtp_host: str
+    smtp_port: int
+    smtp_username: str
+    smtp_password: str
+    smtp_ssl: bool
+    smtp_timeout_seconds: int
+
+
+@dataclass(slots=True)
+class BroadcastEmailRecipient:
+    """Prepared broadcast recipient payload."""
+
+    email: str
+    subject: str
+    body: str
+
+
+def get_system_email_config() -> SystemEmailConfig:
+    """Resolve and validate the env-driven system email configuration."""
+    settings = get_settings()
+    from_address = settings.SYSTEM_EMAIL_FROM_ADDRESS.strip()
+    smtp_host = settings.SYSTEM_SMTP_HOST.strip()
+    smtp_username = settings.SYSTEM_SMTP_USERNAME.strip() or from_address
+    smtp_password = settings.SYSTEM_SMTP_PASSWORD
+
+    if not from_address or not smtp_host or not smtp_password:
+        raise SystemEmailConfigError(
+            "System email is not configured. Set SYSTEM_EMAIL_FROM_ADDRESS, SYSTEM_SMTP_HOST, and SYSTEM_SMTP_PASSWORD."
+        )
+
+    smtp_timeout_seconds = max(1, int(settings.SYSTEM_SMTP_TIMEOUT_SECONDS))
+
+    return SystemEmailConfig(
+        from_address=from_address,
+        from_name=settings.SYSTEM_EMAIL_FROM_NAME.strip() or "Clawith",
+        smtp_host=smtp_host,
+        smtp_port=settings.SYSTEM_SMTP_PORT,
+        smtp_username=smtp_username,
+        smtp_password=smtp_password,
+        smtp_ssl=settings.SYSTEM_SMTP_SSL,
+        smtp_timeout_seconds=smtp_timeout_seconds,
+    )
+
+
+def _send_system_email_sync(to: str, subject: str, body: str) -> None:
+    """Send a plain-text system email synchronously."""
+    config = get_system_email_config()
+
+    msg = MIMEMultipart()
+    msg["From"] = formataddr((config.from_name, config.from_address))
+    msg["To"] = to
+    msg["Subject"] = subject
+    msg["Message-ID"] = make_msgid()
+    msg["Date"] = datetime.now().strftime("%a, %d %b %Y %H:%M:%S %z")
+    msg.attach(MIMEText(body, "plain", "utf-8"))
+
+    with _force_ipv4():
+        if config.smtp_ssl:
+            context = ssl.create_default_context()
+            with smtplib.SMTP_SSL(
+                config.smtp_host,
+                config.smtp_port,
+                context=context,
+                timeout=config.smtp_timeout_seconds,
+            ) as server:
+                server.login(config.smtp_username, config.smtp_password)
+                server.sendmail(config.from_address, [to], msg.as_string())
+        else:
+            with smtplib.SMTP(config.smtp_host, config.smtp_port, timeout=config.smtp_timeout_seconds) as server:
+                server.ehlo()
+                server.starttls(context=ssl.create_default_context())
+                server.ehlo()
+                server.login(config.smtp_username, config.smtp_password)
+                server.sendmail(config.from_address, [to], msg.as_string())
+
+
+async def send_system_email(to: str, subject: str, body: str) -> None:
+    """Send a plain-text system email without blocking the event loop."""
+    await asyncio.to_thread(_send_system_email_sync, to, subject, body)
+
+
+async def send_password_reset_email(
+    to: str,
+    display_name: str,
+    reset_url: str,
+    expiry_minutes: int,
+) -> None:
+    """Send a password reset email."""
+    await send_system_email(
+        to,
+        "Reset your Clawith password",
+        (
+            f"Hello {display_name},\n\n"
+            f"We received a request to reset your Clawith password.\n\n"
+            f"Reset link: {reset_url}\n\n"
+            f"This link expires in {expiry_minutes} minutes. If you did not request this, you can ignore this email."
+        ),
+    )
+
+
+async def deliver_broadcast_emails(recipients: Iterable[BroadcastEmailRecipient]) -> None:
+    """Deliver broadcast emails while isolating per-recipient failures."""
+    for recipient in recipients:
+        try:
+            await send_system_email(recipient.email, recipient.subject, recipient.body)
+        except Exception as exc:
+            logger.warning("Failed to deliver broadcast email to %s: %s", recipient.email, exc)
+
+
+def fire_and_forget(coro) -> None:
+    """Run an awaitable in the background without failing the request."""
+    task = asyncio.create_task(coro)
+
+    def _consume_task_result(done_task: asyncio.Task) -> None:
+        try:
+            done_task.result()
+        except Exception as exc:
+            logger.warning("Background email task failed: %s", exc)
+
+    task.add_done_callback(_consume_task_result)
+
+
+def run_background_email_job(job, *args, **kwargs) -> None:
+    """Bridge Starlette background tasks to async email jobs."""
+    result = job(*args, **kwargs)
+    if inspect.isawaitable(result):
+        fire_and_forget(result)
diff --git a/backend/entrypoint.sh b/backend/entrypoint.sh
index 53eb9385..921cd490 100755
--- a/backend/entrypoint.sh
+++ b/backend/entrypoint.sh
@@ -47,6 +47,7 @@ async def main():
     import app.models.trigger        # noqa
     import app.models.notification   # noqa
     import app.models.gateway_message # noqa
+    import app.models.password_reset_token # noqa
 
     # Create all tables that don't exist yet (safe to run on every startup)
     async with engine.begin() as conn:
diff --git a/backend/tests/test_password_reset_and_notifications.py b/backend/tests/test_password_reset_and_notifications.py
new file mode 100644
index 00000000..56998c79
--- /dev/null
+++ b/backend/tests/test_password_reset_and_notifications.py
@@ -0,0 +1,420 @@
+import contextlib
+import uuid
+from datetime import datetime, timedelta, timezone
+from types import SimpleNamespace
+
+import pytest
+from fastapi import HTTPException
+from starlette.background import BackgroundTasks
+
+from app.api import auth as auth_api
+from app.api.notification import BroadcastRequest, broadcast_notification
+from app.core.security import verify_password
+from app.models.user import User
+from app.schemas.schemas import ForgotPasswordRequest, ResetPasswordRequest
+from app.services import password_reset_service, system_email_service
+from app.services.system_email_service import SystemEmailConfigError
+
+
+class DummyScalars:
+    def __init__(self, values):
+        self._values = list(values)
+
+    def all(self):
+        return list(self._values)
+
+
+class DummyResult:
+    def __init__(self, value=None, values=None):
+        self._value = value
+        self._values = list(values or [])
+
+    def scalar_one_or_none(self):
+        return self._value
+
+    def scalars(self):
+        return DummyScalars(self._values)
+
+
+class MockRedis:
+    def __init__(self, initial_data=None):
+        self._data = initial_data or {}
+        self.deleted = []
+        self.setex_calls = []
+
+    async def get(self, key):
+        return self._data.get(key)
+
+    async def delete(self, key):
+        self.deleted.append(key)
+        self._data.pop(key, None)
+
+    async def setex(self, key, ttl, value):
+        self.setex_calls.append((key, ttl, value))
+        self._data[key] = value
+
+    def pipeline(self, transaction=True):
+        return self
+
+    async def __aenter__(self):
+        return self
+
+    async def __aexit__(self, *_):
+        pass
+
+    async def execute(self):
+        pass
+
+
+class RecordingDB:
+    def __init__(self, responses=None):
+        self.responses = list(responses or [])
+        self.executed = []
+        self.added = []
+        self.flushed = False
+        self.committed = False
+
+    async def execute(self, statement):
+        self.executed.append(statement)
+        if self.responses:
+            return self.responses.pop(0)
+        return DummyResult()
+
+    def add(self, obj):
+        self.added.append(obj)
+
+    async def flush(self):
+        self.flushed = True
+
+    async def commit(self):
+        self.committed = True
+
+
+def make_user(**overrides):
+    values = {
+        "id": uuid.uuid4(),
+        "username": "alice",
+        "email": "alice@example.com",
+        "password_hash": "old-hash",
+        "display_name": "Alice",
+        "role": "member",
+        "tenant_id": uuid.uuid4(),
+        "is_active": True,
+    }
+    values.update(overrides)
+    return User(**values)
+
+
+@pytest.mark.asyncio
+async def test_create_password_reset_token_invalidates_older_tokens(monkeypatch):
+    monkeypatch.setattr(
+        password_reset_service,
+        "get_settings",
+        lambda: SimpleNamespace(PASSWORD_RESET_TOKEN_EXPIRE_MINUTES=15, PUBLIC_BASE_URL=""),
+    )
+    mock_redis = MockRedis(initial_data={"pwd_reset:user:user-id-123": "old-token-hash"})
+    async def fake_get_redis(): return mock_redis
+    monkeypatch.setattr(password_reset_service, "get_redis", fake_get_redis)
+
+    db = RecordingDB()
+    user_id = uuid.uuid4()
+
+    raw_token, expires_at = await password_reset_service.create_password_reset_token(user_id)
+
+    # Verify old token invalidation
+    assert "pwd_reset:token:old-token-hash" in mock_redis.deleted
+
+    # Verify new token storage
+    assert len(mock_redis.setex_calls) == 2
+    # Verify raw token is long
+    assert len(raw_token) >= 20
+    assert expires_at > datetime.now(timezone.utc)
+
+
+@pytest.mark.asyncio
+async def test_build_password_reset_url_uses_env_public_base_url(monkeypatch):
+    monkeypatch.setattr(
+        password_reset_service,
+        "get_settings",
+        lambda: SimpleNamespace(PASSWORD_RESET_TOKEN_EXPIRE_MINUTES=30, PUBLIC_BASE_URL="https://app.example.com/"),
+    )
+    db = RecordingDB([DummyResult(None)])
+
+    url = await password_reset_service.build_password_reset_url(db, "abc123")
+
+    assert url == "https://app.example.com/reset-password?token=abc123"
+
+
+@pytest.mark.asyncio
+async def test_consume_password_reset_token_works_correctly(monkeypatch):
+    user_id = uuid.uuid4()
+    raw_token = "raw-token"
+    token_hash = password_reset_service._hash_token(raw_token)
+    
+    initial_data = {
+        f"pwd_reset:token:{token_hash}": str(user_id),
+        f"pwd_reset:user:{user_id}": token_hash,
+    }
+    mock_redis = MockRedis(initial_data=initial_data)
+    async def fake_get_redis(): return mock_redis
+    monkeypatch.setattr(password_reset_service, "get_redis", fake_get_redis)
+
+    db = RecordingDB()
+    result = await password_reset_service.consume_password_reset_token(raw_token)
+
+    assert result is not None
+    assert result["user_id"] == user_id
+    # Should be deleted after consumption
+    assert f"pwd_reset:token:{token_hash}" in mock_redis.deleted
+    assert f"pwd_reset:user:{user_id}" in mock_redis.deleted
+
+
+@pytest.mark.asyncio
+async def test_forgot_password_returns_generic_response_for_unknown_email():
+    db = RecordingDB([DummyResult(None)])
+    background_tasks = BackgroundTasks()
+
+    response = await auth_api.forgot_password(
+        ForgotPasswordRequest(email="missing@example.com"),
+        background_tasks,
+        db,
+    )
+
+    assert response == {
+        "ok": True,
+        "message": "If an account with that email exists, a password reset email has been sent.",
+    }
+    assert background_tasks.tasks == []
+
+
+@pytest.mark.asyncio
+async def test_forgot_password_hides_email_delivery_failures(monkeypatch):
+    user = make_user()
+    db = RecordingDB([DummyResult(user)])
+    background_tasks = BackgroundTasks()
+
+    def fake_get_system_email_config():
+        raise RuntimeError("smtp failed")
+
+    monkeypatch.setattr("app.services.system_email_service.get_system_email_config", fake_get_system_email_config)
+
+    response = await auth_api.forgot_password(ForgotPasswordRequest(email=user.email), background_tasks, db)
+
+    assert response["ok"] is True
+    assert "password reset email" in response["message"]
+    assert background_tasks.tasks == []
+
+
+@pytest.mark.asyncio
+async def test_forgot_password_queues_background_email(monkeypatch):
+    user = make_user()
+    db = RecordingDB([DummyResult(user)])
+    background_tasks = BackgroundTasks()
+
+    async def fake_create_password_reset_token(*_args, **_kwargs):
+        return "raw-token", datetime.now(timezone.utc) + timedelta(minutes=30)
+
+    async def fake_build_password_reset_url(*_args, **_kwargs):
+        return "https://app.example.com/reset-password?token=raw-token"
+
+    monkeypatch.setattr(password_reset_service, "create_password_reset_token", fake_create_password_reset_token)
+    monkeypatch.setattr(password_reset_service, "build_password_reset_url", fake_build_password_reset_url)
+    monkeypatch.setattr(
+        "app.services.system_email_service.get_system_email_config",
+        lambda: SimpleNamespace(from_address="bot@example.com"),
+    )
+
+    response = await auth_api.forgot_password(ForgotPasswordRequest(email=user.email), background_tasks, db)
+
+    assert response["ok"] is True
+    assert db.committed is True
+    assert len(background_tasks.tasks) == 1
+
+
+def test_system_email_config_uses_configured_timeout(monkeypatch):
+    monkeypatch.setattr(
+        system_email_service,
+        "get_settings",
+        lambda: SimpleNamespace(
+            SYSTEM_EMAIL_FROM_ADDRESS="bot@example.com",
+            SYSTEM_EMAIL_FROM_NAME="Clawith",
+            SYSTEM_SMTP_HOST="smtp.example.com",
+            SYSTEM_SMTP_PORT=465,
+            SYSTEM_SMTP_USERNAME="",
+            SYSTEM_SMTP_PASSWORD="secret",
+            SYSTEM_SMTP_SSL=True,
+            SYSTEM_SMTP_TIMEOUT_SECONDS=42,
+        ),
+    )
+
+    config = system_email_service.get_system_email_config()
+
+    assert config.smtp_timeout_seconds == 42
+
+
+def test_system_email_config_clamps_non_positive_timeout(monkeypatch):
+    monkeypatch.setattr(
+        system_email_service,
+        "get_settings",
+        lambda: SimpleNamespace(
+            SYSTEM_EMAIL_FROM_ADDRESS="bot@example.com",
+            SYSTEM_EMAIL_FROM_NAME="Clawith",
+            SYSTEM_SMTP_HOST="smtp.example.com",
+            SYSTEM_SMTP_PORT=465,
+            SYSTEM_SMTP_USERNAME="",
+            SYSTEM_SMTP_PASSWORD="secret",
+            SYSTEM_SMTP_SSL=True,
+            SYSTEM_SMTP_TIMEOUT_SECONDS=0,
+        ),
+    )
+
+    config = system_email_service.get_system_email_config()
+
+    assert config.smtp_timeout_seconds == 1
+
+
+def test_send_system_email_uses_configured_timeout(monkeypatch):
+    captured = {}
+
+    class DummySMTPSSL:
+        def __init__(self, host: str, port: int, context=None, timeout: int | None = None):
+            captured["host"] = host
+            captured["port"] = port
+            captured["timeout"] = timeout
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, exc_type, exc, tb):
+            return False
+
+        def login(self, username: str, password: str):
+            captured["username"] = username
+            captured["password"] = password
+
+        def sendmail(self, from_address: str, to_addresses: list[str], message: str):
+            captured["from"] = from_address
+            captured["to"] = to_addresses
+            captured["has_message"] = bool(message)
+
+    monkeypatch.setattr(
+        system_email_service,
+        "get_system_email_config",
+        lambda: system_email_service.SystemEmailConfig(
+            from_address="bot@example.com",
+            from_name="Clawith",
+            smtp_host="smtp.example.com",
+            smtp_port=465,
+            smtp_username="bot@example.com",
+            smtp_password="secret",
+            smtp_ssl=True,
+            smtp_timeout_seconds=27,
+        ),
+    )
+    monkeypatch.setattr(system_email_service.smtplib, "SMTP_SSL", DummySMTPSSL)
+    monkeypatch.setattr(system_email_service, "_force_ipv4", lambda: contextlib.nullcontext())
+
+    system_email_service._send_system_email_sync("alice@example.com", "subject", "body")
+
+    assert captured["timeout"] == 27
+    assert captured["to"] == ["alice@example.com"]
+
+
+@pytest.mark.asyncio
+async def test_reset_password_updates_user(monkeypatch):
+    user = make_user(password_hash=auth_api.hash_password("old-password"))
+    db = RecordingDB([DummyResult(user)])
+
+    async def fake_consume_password_reset_token(*_args, **_kwargs):
+        return {"user_id": user.id}
+
+    monkeypatch.setattr(password_reset_service, "consume_password_reset_token", fake_consume_password_reset_token)
+
+    response = await auth_api.reset_password(
+        ResetPasswordRequest(token="t" * 20, new_password="new-password"),
+        db,
+    )
+
+    assert response == {"ok": True}
+    assert verify_password("new-password", user.password_hash)
+    assert db.flushed is True
+
+
+@pytest.mark.asyncio
+async def test_broadcast_notification_rejects_missing_system_email_config(monkeypatch):
+    current_user = make_user(role="org_admin")
+
+    def fake_get_system_email_config():
+        raise SystemEmailConfigError("missing smtp host")
+
+    monkeypatch.setattr(
+        "app.services.system_email_service.get_system_email_config",
+        fake_get_system_email_config,
+    )
+
+    with pytest.raises(HTTPException) as excinfo:
+        await broadcast_notification(
+            BroadcastRequest(title="Maintenance", body="Tonight", send_email=True),
+            background_tasks=BackgroundTasks(),
+            current_user=current_user,
+            db=RecordingDB(),
+        )
+
+    assert excinfo.value.status_code == 400
+    assert "System email is not configured" in excinfo.value.detail
+
+
+@pytest.mark.asyncio
+async def test_broadcast_notification_queues_email_delivery(monkeypatch):
+    current_user = make_user(role="org_admin")
+    target_user = make_user(email="bob@example.com", tenant_id=current_user.tenant_id)
+    db = RecordingDB([
+        DummyResult(values=[target_user]),
+        DummyResult(values=[]),
+    ])
+    background_tasks = BackgroundTasks()
+
+    monkeypatch.setattr(
+        "app.services.system_email_service.get_system_email_config",
+        lambda: SimpleNamespace(from_address="bot@example.com"),
+    )
+    notifications = []
+
+    async def fake_send_notification(*_args, **kwargs):
+        notifications.append(kwargs)
+
+    monkeypatch.setattr("app.services.notification_service.send_notification", fake_send_notification)
+
+    response = await broadcast_notification(
+        BroadcastRequest(title="Maintenance", body="Tonight", send_email=True),
+        background_tasks=background_tasks,
+        current_user=current_user,
+        db=db,
+    )
+
+    assert response["ok"] is True
+    assert response["emails_sent"] == 1
+    assert db.committed is True
+    assert len(notifications) == 1
+    assert len(background_tasks.tasks) == 1
+
+
+@pytest.mark.asyncio
+async def test_deliver_broadcast_emails_continues_after_single_failure(monkeypatch):
+    from app.services.system_email_service import BroadcastEmailRecipient, deliver_broadcast_emails
+
+    delivered = []
+
+    async def fake_send_system_email(email: str, subject: str, body: str) -> None:
+        if email == "bad@example.com":
+            raise RuntimeError("smtp down")
+        delivered.append((email, subject, body))
+
+    monkeypatch.setattr("app.services.system_email_service.send_system_email", fake_send_system_email)
+
+    await deliver_broadcast_emails([
+        BroadcastEmailRecipient(email="bad@example.com", subject="s1", body="b1"),
+        BroadcastEmailRecipient(email="good@example.com", subject="s2", body="b2"),
+    ])
+
+    assert delivered == [("good@example.com", "s2", "b2")]
diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index e4a08928..d7948287 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -3,6 +3,8 @@ import { useAuthStore } from './stores';
 import { useEffect, useState } from 'react';
 import { authApi } from './services/api';
 import Login from './pages/Login';
+import ForgotPassword from './pages/ForgotPassword';
+import ResetPassword from './pages/ResetPassword';
 import CompanySetup from './pages/CompanySetup';
 import Layout from './pages/Layout';
 import Dashboard from './pages/Dashboard';
@@ -105,6 +107,8 @@ export default function App() {
             <NotificationBar />
             <Routes>
                 <Route path="/login" element={<Login />} />
+                <Route path="/forgot-password" element={<ForgotPassword />} />
+                <Route path="/reset-password" element={<ResetPassword />} />
                 <Route path="/sso/entry" element={<SSOEntry />} />
                 <Route path="/setup-company" element={<CompanySetup />} />
                 <Route path="/" element={<ProtectedRoute><Layout /></ProtectedRoute>}>
diff --git a/frontend/src/i18n/en.json b/frontend/src/i18n/en.json
index e212b778..c22b1d91 100644
--- a/frontend/src/i18n/en.json
+++ b/frontend/src/i18n/en.json
@@ -55,7 +55,6 @@
     "language": "Language",
     "plaza": "Plaza"
   },
-
   "auth": {
     "login": "Login",
     "register": "Register",
@@ -80,6 +79,26 @@
     "usernamePlaceholder": "Enter username",
     "passwordPlaceholder": "Enter password",
     "emailPlaceholder": "you@example.com",
+    "forgotPassword": "Forgot password?",
+    "forgotPasswordTitle": "Forgot password",
+    "forgotPasswordSubtitle": "Enter your account email and we will send a reset link if the account exists.",
+    "forgotPasswordRequestFailed": "Failed to request password reset",
+    "sendResetLink": "Send reset link",
+    "rememberedPassword": "Remembered your password?",
+    "backToLogin": "Back to login",
+    "resetPasswordTitle": "Reset password",
+    "resetPasswordSubtitle": "Choose a new password for your account.",
+    "resetPasswordMissingToken": "Reset token is missing from the link.",
+    "resetPasswordTooShort": "New password must be at least 6 characters.",
+    "resetPasswordMismatch": "Passwords do not match.",
+    "resetPasswordFailed": "Failed to reset password",
+    "resetPasswordSuccess": "Password updated. Redirecting to login...",
+    "newPassword": "New password",
+    "newPasswordPlaceholder": "At least 6 characters",
+    "confirmNewPassword": "Confirm new password",
+    "confirmNewPasswordPlaceholder": "Repeat your new password",
+    "updatePassword": "Update password",
+    "emailPlaceholderReset": "name@company.com",
     "companyDisabled": "Your company has been disabled. Please contact the platform administrator.",
     "invalidCredentials": "Invalid username or password.",
     "accountDisabled": "Your account has been disabled.",
@@ -302,7 +321,6 @@
       "heartbeatDesc": "Instructions for periodic awareness checks. The agent reads this file during each heartbeat.",
       "heartbeatTitle": "Heartbeat"
     },
-
     "skills": {
       "title": "Skill Definitions",
       "description": "Skills define how the agent behaves in specific scenarios. Each .md file is a skill. Use YAML frontmatter (name + description) for best results.",
@@ -800,6 +818,15 @@
       "saved": "Saved",
       "themeColor": "Theme Color"
     },
+    "broadcast": {
+      "title": "Broadcast Notification",
+      "description": "Send a notification to all users and agents in this company.",
+      "titlePlaceholder": "Notification title",
+      "bodyPlaceholder": "Optional details...",
+      "sendEmail": "Also send email to users with a configured address",
+      "send": "Send Broadcast",
+      "sentWithEmail": "Sent to {{users}} users, {{agents}} agents, and {{emails}} email recipients"
+    },
     "kb": {
       "title": "Company Knowledge Base",
       "rootDir": "Root",
diff --git a/frontend/src/i18n/zh.json b/frontend/src/i18n/zh.json
index 4805823c..faf49d02 100644
--- a/frontend/src/i18n/zh.json
+++ b/frontend/src/i18n/zh.json
@@ -86,6 +86,26 @@
     "usernamePlaceholder": "请输入用户名",
     "passwordPlaceholder": "请输入密码",
     "emailPlaceholder": "your@email.com",
+    "forgotPassword": "忘记密码？",
+    "forgotPasswordTitle": "忘记密码",
+    "forgotPasswordSubtitle": "输入你的账号邮箱；如果该账号存在，系统会发送一封重置链接邮件。",
+    "forgotPasswordRequestFailed": "请求密码重置失败",
+    "sendResetLink": "发送重置链接",
+    "rememberedPassword": "想起密码了？",
+    "backToLogin": "返回登录",
+    "resetPasswordTitle": "重置密码",
+    "resetPasswordSubtitle": "为你的账号设置一个新密码。",
+    "resetPasswordMissingToken": "链接中缺少重置令牌。",
+    "resetPasswordTooShort": "新密码至少需要 6 个字符。",
+    "resetPasswordMismatch": "两次输入的密码不一致。",
+    "resetPasswordFailed": "重置密码失败",
+    "resetPasswordSuccess": "密码已更新，正在跳转到登录页...",
+    "newPassword": "新密码",
+    "newPasswordPlaceholder": "至少 6 个字符",
+    "confirmNewPassword": "确认新密码",
+    "confirmNewPasswordPlaceholder": "再次输入新密码",
+    "updatePassword": "更新密码",
+    "emailPlaceholderReset": "name@company.com",
     "companyDisabled": "你的公司已被停用，请联系平台管理员。",
     "invalidCredentials": "用户名或密码错误。",
     "accountDisabled": "你的账号已被停用。",
@@ -866,6 +886,15 @@
       "saved": "已保存",
       "themeColor": "主题色"
     },
+    "broadcast": {
+      "title": "广播通知",
+      "description": "向本公司所有用户和数字员工发送通知。",
+      "titlePlaceholder": "通知标题",
+      "bodyPlaceholder": "可选补充说明...",
+      "sendEmail": "同时给已配置邮箱地址的用户发送邮件",
+      "send": "发送广播",
+      "sentWithEmail": "已发送给 {{users}} 位用户、{{agents}} 个数字员工，并投递到 {{emails}} 个邮箱"
+    },
     "companyName": {
       "title": "公司名称",
       "placeholder": "输入公司名称"
diff --git a/frontend/src/pages/EnterpriseSettings.tsx b/frontend/src/pages/EnterpriseSettings.tsx
index cf1e4da4..93b4ffa4 100644
--- a/frontend/src/pages/EnterpriseSettings.tsx
+++ b/frontend/src/pages/EnterpriseSettings.tsx
@@ -1519,8 +1519,9 @@ function BroadcastSection() {
     const { t } = useTranslation();
     const [title, setTitle] = useState('');
     const [body, setBody] = useState('');
+    const [sendEmail, setSendEmail] = useState(false);
     const [sending, setSending] = useState(false);
-    const [result, setResult] = useState<{ users: number; agents: number } | null>(null);
+    const [result, setResult] = useState<{ users: number; agents: number; emails: number } | null>(null);
 
     const handleSend = async () => {
         if (!title.trim()) return;
@@ -1531,7 +1532,7 @@ function BroadcastSection() {
             const res = await fetch('/api/notifications/broadcast', {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
-                body: JSON.stringify({ title: title.trim(), body: body.trim() }),
+                body: JSON.stringify({ title: title.trim(), body: body.trim(), send_email: sendEmail }),
             });
             if (!res.ok) {
                 const err = await res.json().catch(() => ({}));
@@ -1540,9 +1541,14 @@ function BroadcastSection() {
                 return;
             }
             const data = await res.json();
-            setResult({ users: data.users_notified, agents: data.agents_notified });
+            setResult({
+                users: data.users_notified,
+                agents: data.agents_notified,
+                emails: data.emails_sent || 0,
+            });
             setTitle('');
             setBody('');
+            setSendEmail(false);
         } catch (e: any) {
             alert(e.message || 'Failed');
         }
@@ -1573,13 +1579,25 @@ function BroadcastSection() {
                     rows={3}
                     style={{ resize: 'vertical', fontSize: '13px', marginBottom: '12px' }}
                 />
+                <label style={{ display: 'flex', alignItems: 'center', gap: '8px', marginBottom: '12px', fontSize: '13px' }}>
+                    <input
+                        type="checkbox"
+                        checked={sendEmail}
+                        onChange={e => setSendEmail(e.target.checked)}
+                    />
+                    <span>{t('enterprise.broadcast.sendEmail', 'Also send email to users with a configured address')}</span>
+                </label>
                 <div style={{ display: 'flex', gap: '8px', alignItems: 'center' }}>
                     <button className="btn btn-primary" onClick={handleSend} disabled={sending || !title.trim()}>
                         {sending ? t('common.loading') : t('enterprise.broadcast.send', 'Send Broadcast')}
                     </button>
                     {result && (
                         <span style={{ fontSize: '12px', color: 'var(--text-secondary)' }}>
-                            {t('enterprise.broadcast.sent', `Sent to ${result.users} users and ${result.agents} agents`, { users: result.users, agents: result.agents })}
+                            {t(
+                                'enterprise.broadcast.sentWithEmail',
+                                `Sent to ${result.users} users, ${result.agents} agents, and ${result.emails} email recipients`,
+                                { users: result.users, agents: result.agents, emails: result.emails },
+                            )}
                         </span>
                     )}
                 </div>
diff --git a/frontend/src/pages/ForgotPassword.tsx b/frontend/src/pages/ForgotPassword.tsx
new file mode 100644
index 00000000..26c05f92
--- /dev/null
+++ b/frontend/src/pages/ForgotPassword.tsx
@@ -0,0 +1,85 @@
+import { useEffect, useState } from 'react';
+import { Link } from 'react-router-dom';
+import { useTranslation } from 'react-i18next';
+import { authApi } from '../services/api';
+
+export default function ForgotPassword() {
+    const { t } = useTranslation();
+    const [email, setEmail] = useState('');
+    const [loading, setLoading] = useState(false);
+    const [error, setError] = useState('');
+    const [message, setMessage] = useState('');
+
+    useEffect(() => {
+        document.documentElement.setAttribute('data-theme', 'dark');
+    }, []);
+
+    const handleSubmit = async (e: React.FormEvent) => {
+        e.preventDefault();
+        setError('');
+        setMessage('');
+        setLoading(true);
+
+        try {
+            const res = await authApi.forgotPassword({ email: email.trim() });
+            setMessage(res.message);
+        } catch (err: any) {
+            setError(err.message || t('auth.forgotPasswordRequestFailed', 'Failed to request password reset'));
+        } finally {
+            setLoading(false);
+        }
+    };
+
+    return (
+        <div className="login-page">
+            <div className="login-form-panel" style={{ width: '100%', display: 'flex', justifyContent: 'center' }}>
+                <div className="login-form-wrapper" style={{ maxWidth: '460px' }}>
+                    <div className="login-form-header">
+                        <div className="login-form-logo">
+                            <img src="/logo-black.png" className="login-logo-img" alt="" style={{ width: 28, height: 28, marginRight: 8, verticalAlign: 'middle' }} />
+                            Clawith
+                        </div>
+                        <h2 className="login-form-title">{t('auth.forgotPasswordTitle', 'Forgot password')}</h2>
+                        <p className="login-form-subtitle">
+                            {t('auth.forgotPasswordSubtitle', 'Enter your account email and we will send a reset link if the account exists.')}
+                        </p>
+                    </div>
+
+                    {error && (
+                        <div className="login-error">
+                            <span>⚠</span> {error}
+                        </div>
+                    )}
+
+                    {message && (
+                        <div className="login-error" style={{ background: 'rgba(34,197,94,0.14)', borderColor: 'rgba(34,197,94,0.35)', color: '#dcfce7' }}>
+                            <span>✓</span> {message}
+                        </div>
+                    )}
+
+                    <form onSubmit={handleSubmit} className="login-form">
+                        <div className="login-field">
+                            <label>{t('auth.email', 'Email')}</label>
+                            <input
+                                type="email"
+                                value={email}
+                                onChange={(e) => setEmail(e.target.value)}
+                                required
+                                autoFocus
+                                placeholder={t('auth.emailPlaceholderReset', 'name@company.com')}
+                            />
+                        </div>
+
+                        <button className="login-submit" type="submit" disabled={loading || !email.trim()}>
+                            {loading ? <span className="login-spinner" /> : t('auth.sendResetLink', 'Send reset link')}
+                        </button>
+                    </form>
+
+                    <div className="login-switch">
+                        {t('auth.rememberedPassword', 'Remembered your password?')} <Link to="/login">{t('auth.backToLogin', 'Back to login')}</Link>
+                    </div>
+                </div>
+            </div>
+        </div>
+    );
+}
diff --git a/frontend/src/pages/Login.tsx b/frontend/src/pages/Login.tsx
index e8a779a5..f6c7f088 100644
--- a/frontend/src/pages/Login.tsx
+++ b/frontend/src/pages/Login.tsx
@@ -1,5 +1,5 @@
 import { useState, useEffect } from 'react';
-import { useNavigate } from 'react-router-dom';
+import { Link, useNavigate } from 'react-router-dom';
 import { useTranslation } from 'react-i18next';
 import { useAuthStore } from '../stores';
 import { authApi, tenantApi, fetchJson } from '../services/api';
@@ -318,6 +318,17 @@ export default function Login() {
                             />
                         </div>
 
+                        {!isRegister && (
+                            <div style={{ display: 'flex', justifyContent: 'flex-end', marginTop: '-4px', marginBottom: '8px' }}>
+                                <Link
+                                    to="/forgot-password"
+                                    style={{ fontSize: '13px', color: 'var(--accent-primary)', textDecoration: 'none' }}
+                                >
+                                    {t('auth.forgotPassword', 'Forgot password?')}
+                                </Link>
+                            </div>
+                        )}
+
                         <button className="login-submit" type="submit" disabled={loading}>
                             {loading ? (
                                 <span className="login-spinner" />
diff --git a/frontend/src/pages/ResetPassword.tsx b/frontend/src/pages/ResetPassword.tsx
new file mode 100644
index 00000000..a2432c5c
--- /dev/null
+++ b/frontend/src/pages/ResetPassword.tsx
@@ -0,0 +1,113 @@
+import { useEffect, useMemo, useState } from 'react';
+import { Link, useNavigate, useSearchParams } from 'react-router-dom';
+import { useTranslation } from 'react-i18next';
+import { authApi } from '../services/api';
+
+export default function ResetPassword() {
+    const { t } = useTranslation();
+    const navigate = useNavigate();
+    const [params] = useSearchParams();
+    const token = useMemo(() => params.get('token') || '', [params]);
+    const [password, setPassword] = useState('');
+    const [confirmPassword, setConfirmPassword] = useState('');
+    const [loading, setLoading] = useState(false);
+    const [error, setError] = useState('');
+    const [success, setSuccess] = useState(false);
+
+    useEffect(() => {
+        document.documentElement.setAttribute('data-theme', 'dark');
+    }, []);
+
+    const handleSubmit = async (e: React.FormEvent) => {
+        e.preventDefault();
+        setError('');
+
+        if (!token) {
+            setError(t('auth.resetPasswordMissingToken', 'Reset token is missing from the link.'));
+            return;
+        }
+        if (password.length < 6) {
+            setError(t('auth.resetPasswordTooShort', 'New password must be at least 6 characters.'));
+            return;
+        }
+        if (password !== confirmPassword) {
+            setError(t('auth.resetPasswordMismatch', 'Passwords do not match.'));
+            return;
+        }
+
+        setLoading(true);
+        try {
+            await authApi.resetPassword({ token, new_password: password });
+            setSuccess(true);
+            window.setTimeout(() => navigate('/login'), 1200);
+        } catch (err: any) {
+            setError(err.message || t('auth.resetPasswordFailed', 'Failed to reset password'));
+        } finally {
+            setLoading(false);
+        }
+    };
+
+    return (
+        <div className="login-page">
+            <div className="login-form-panel" style={{ width: '100%', display: 'flex', justifyContent: 'center' }}>
+                <div className="login-form-wrapper" style={{ maxWidth: '460px' }}>
+                    <div className="login-form-header">
+                        <div className="login-form-logo">
+                            <img src="/logo-black.png" className="login-logo-img" alt="" style={{ width: 28, height: 28, marginRight: 8, verticalAlign: 'middle' }} />
+                            Clawith
+                        </div>
+                        <h2 className="login-form-title">{t('auth.resetPasswordTitle', 'Reset password')}</h2>
+                        <p className="login-form-subtitle">
+                            {t('auth.resetPasswordSubtitle', 'Choose a new password for your account.')}
+                        </p>
+                    </div>
+
+                    {error && (
+                        <div className="login-error">
+                            <span>⚠</span> {error}
+                        </div>
+                    )}
+
+                    {success && (
+                        <div className="login-error" style={{ background: 'rgba(34,197,94,0.14)', borderColor: 'rgba(34,197,94,0.35)', color: '#dcfce7' }}>
+                            <span>✓</span> {t('auth.resetPasswordSuccess', 'Password updated. Redirecting to login...')}
+                        </div>
+                    )}
+
+                    <form onSubmit={handleSubmit} className="login-form">
+                        <div className="login-field">
+                            <label>{t('auth.newPassword', 'New password')}</label>
+                            <input
+                                type="password"
+                                value={password}
+                                onChange={(e) => setPassword(e.target.value)}
+                                required
+                                autoFocus
+                                placeholder={t('auth.newPasswordPlaceholder', 'At least 6 characters')}
+                            />
+                        </div>
+
+                        <div className="login-field">
+                            <label>{t('auth.confirmNewPassword', 'Confirm new password')}</label>
+                            <input
+                                type="password"
+                                value={confirmPassword}
+                                onChange={(e) => setConfirmPassword(e.target.value)}
+                                required
+                                placeholder={t('auth.confirmNewPasswordPlaceholder', 'Repeat your new password')}
+                            />
+                        </div>
+
+                        <button className="login-submit" type="submit" disabled={loading || success}>
+                            {loading ? <span className="login-spinner" /> : t('auth.updatePassword', 'Update password')}
+                        </button>
+                    </form>
+
+                    <div className="login-switch">
+                        <Link to="/login">{t('auth.backToLogin', 'Back to login')}</Link>
+                    </div>
+                </div>
+            </div>
+        </div>
+    );
+}
diff --git a/frontend/src/services/api.ts b/frontend/src/services/api.ts
index 8ec2ed72..d085200a 100644
--- a/frontend/src/services/api.ts
+++ b/frontend/src/services/api.ts
@@ -15,7 +15,10 @@ async function request<T>(url: string, options: RequestInit = {}): Promise<T> {
 
     if (!res.ok) {
         // Auto-logout on expired/invalid token (but not on auth endpoints — let them show errors)
-        const isAuthEndpoint = url.startsWith('/auth/login') || url.startsWith('/auth/register');
+        const isAuthEndpoint = url.startsWith('/auth/login')
+            || url.startsWith('/auth/register')
+            || url.startsWith('/auth/forgot-password')
+            || url.startsWith('/auth/reset-password');
         if (res.status === 401 && !isAuthEndpoint) {
             localStorage.removeItem('token');
             localStorage.removeItem('user');
@@ -136,6 +139,12 @@ export const authApi = {
     login: (data: { username: string; password: string; tenant_id?: string }) =>
         request<TokenResponse>('/auth/login', { method: 'POST', body: JSON.stringify(data) }),
 
+    forgotPassword: (data: { email: string }) =>
+        request<{ ok: boolean; message: string }>('/auth/forgot-password', { method: 'POST', body: JSON.stringify(data) }),
+
+    resetPassword: (data: { token: string; new_password: string }) =>
+        request<{ ok: boolean }>('/auth/reset-password', { method: 'POST', body: JSON.stringify(data) }),
+
     me: () => request<User>('/auth/me'),
 
     updateMe: (data: Partial<User>) =>