        $out[] = hed(gTxt('change_password'), 1, array('id' => 'txp-change-password-heading')).
            n.tag(
                n.tag(gTxt('new_password'), 'label', array(
                    'class' => 'txp-form-field-label',
                    'for' => 'change_password',
                )).
                fInput('password', 'p_password', '', 'txp-form-field-input txp-maskable', '', '', INPUT_REGULAR, '', 'change_password', false, true),
                'div', array('class' => 'txp-form-field change-password')).
            graf(
                checkbox('unmask', 1, false, 0, 'show_password').n.
                tag(gTxt('show_password'), 'label', array('for' => 'show_password'))
                , array('class' => 'show-password')).
            graf(
                fInput('submit', '', gTxt('password_confirm_button'), 'publish').n
            ).
            graf(
                href(gTxt('back_to_login'), 'index.php'), array('class' => 'login-return'));
        $out[] = hInput('hash', gps('confirm'));
        $out[] = hInput('p_alter', 1);
    } else {
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.