diff --git a/pb_public/index.html b/pb_public/index.html
index d6a4f3e..1e30eea 100644
--- a/pb_public/index.html
+++ b/pb_public/index.html
@@ -118,6 +118,18 @@
       <input id="pass" type="password" autocomplete="current-password">
       <button id="loginBtn" class="btn primary">Přihlásit se</button>
       <div id="anonMsg" class="msg"></div>
+      <p class="hint"><a href="#" id="forgotLink">Zapomenuté heslo?</a></p>
+
+      <!-- Hidden until asked for: the overwhelmingly common visit is somebody
+           who remembers their password, and a reset field on the way in invites
+           people to reach for it first. -->
+      <div id="forgot" hidden>
+        <label for="fEmail">E-mail účtu</label>
+        <input id="fEmail" type="email" autocomplete="username" inputmode="email">
+        <button id="forgotBtn" class="btn">Poslat odkaz na nové heslo</button>
+        <div id="forgotMsg" class="msg"></div>
+      </div>
+
       <p class="hint">Účty zakládá Richard — registrace tu není. Když se nemůžeš
         dostat dovnitř, napiš mu.</p>
     </div>
@@ -505,7 +517,11 @@ async function restore(){
 }
 
 $("loginBtn").onclick=async function(){
-  var email=$("email").value.trim(), pass=$("pass").value;
+  // Lower-cased, not just trimmed. PocketBase looks accounts up
+  // case-sensitively, so an address typed with a capital — which phones do by
+  // themselves — matches nothing and reads as a wrong password. It cost a
+  // family member two days and four failed password resets.
+  var email=$("email").value.trim().toLowerCase(), pass=$("pass").value;
   if(!email||!pass){ setMsg($("anonMsg"),"Vyplň e-mail i heslo.","err"); return; }
   setMsg($("anonMsg"),""); busy($("loginBtn"),true,"Přihlašuji…");
   var r=await api("POST","/api/collections/users/auth-with-password",
@@ -516,6 +532,30 @@ $("loginBtn").onclick=async function(){
   TOKEN=r.data.token; USER=r.data.record; PASSWORD=pass; saveSession();
   await enter();
 };
+$("forgotLink").onclick=function(e){
+  e.preventDefault();
+  var box=$("forgot");
+  box.hidden=!box.hidden;
+  if(!box.hidden){ $("fEmail").value=$("email").value; $("fEmail").focus(); }
+};
+
+$("forgotBtn").onclick=async function(){
+  var email=$("fEmail").value.trim().toLowerCase();
+  if(!email){ setMsg($("forgotMsg"),"Vyplň e-mail.","err"); return; }
+  setMsg($("forgotMsg"),""); busy($("forgotBtn"),true,"Odesílám…");
+  var r=await api("POST","/api/collections/users/request-password-reset",
+    { email:email }, {anon:true});
+  busy($("forgotBtn"),false);
+  // The server answers the same whether or not the account exists — on purpose,
+  // so nobody can use this to find out which addresses are registered. So the
+  // message says what was DONE, never whether it matched: promising "sent" for
+  // an address with no account is the lie that made the last outage so hard to
+  // read from the outside.
+  if(!r.ok){ setMsg($("forgotMsg"),"Nepovedlo se odeslat. Zkus to za chvíli.","err"); return; }
+  setMsg($("forgotMsg"),"Pokud k té adrese účet existuje, přišel na ni odkaz. "+
+    "Mrkni i do spamu. Když nic nedorazí, napiš Richardovi — heslo ti nastaví přímo.","ok");
+};
+
 $("logoutBtn").onclick=signOut;
 
 // ── shell ────────────────────────────────────────────────────────────────────