diff --git a/app/views/devise/passwords/edit.html.erb b/app/views/devise/passwords/edit.html.erb
index 5fbb9ff0a..df482298d 100644
--- a/app/views/devise/passwords/edit.html.erb
+++ b/app/views/devise/passwords/edit.html.erb
@@ -1,25 +1,24 @@
-<h2>Change your password</h2>
-
 <%= form_for(resource, as: resource_name, url: password_path(resource_name), html: { method: :put }) do |f| %>
-  <%= render "devise/shared/error_messages", resource: resource %>
-  <%= f.hidden_field :reset_password_token %>
+  <div class="govuk-grid-row">
+    <div class="govuk-grid-column-two-thirds">
+      <h1 class="govuk-heading-l">Reset your password</h1>
+      <%= render "devise/shared/error_messages", resource: resource %>
+      <%= f.hidden_field :reset_password_token %>
 
-  <div class="field">
-    <%= f.label :password, "New password" %><br />
-    <% if @minimum_password_length %>
-      <em>(<%= @minimum_password_length %> characters minimum)</em><br />
-    <% end %>
-    <%= f.password_field :password, autofocus: true, autocomplete: "new-password" %>
-  </div>
+      <div class="govuk-form-group">
+        <%= f.label :password, "New password", class: "govuk-label" %>
+        <% if @minimum_password_length %>
+          <div class="govuk-hint">Your password must be at least 8 characters and hard to guess.</div>
+        <% end %>
+        <%= f.password_field :password, autofocus: true, autocomplete: "new-password", class: "govuk-input"  %>
+      </div>
 
-  <div class="field">
-    <%= f.label :password_confirmation, "Confirm new password" %><br />
-    <%= f.password_field :password_confirmation, autocomplete: "new-password" %>
-  </div>
+      <div class="govuk-form-group">
+        <%= f.label :password_confirmation, "Confirm new password", class: "govuk-label" %>
+        <%= f.password_field :password_confirmation, autocomplete: "new-password", class: "govuk-input"  %>
+      </div>
 
-  <div class="actions">
-    <%= f.submit "Change my password" %>
+      <%= f.submit "Reset password", class: "govuk-button" %>
+    </div>
   </div>
 <% end %>
-
-<%= render "devise/shared/links" %>
diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb
index dc6872604..3c359b079 100644
--- a/config/initializers/devise.rb
+++ b/config/initializers/devise.rb
@@ -178,7 +178,7 @@ Devise.setup do |config|
 
   # ==> Configuration for :validatable
   # Range for password length.
-  config.password_length = 6..128
+  config.password_length = 8..128
 
   # Email regex used to validate email formats. It simply asserts that
   # one (and only one) @ exists in the given string. This is mainly
@@ -224,7 +224,7 @@ Devise.setup do |config|
   # Time interval you can reset your password with a reset password key.
   # Don't put a too small interval or your users won't have the time to
   # change their passwords.
-  config.reset_password_within = 6.hours
+  config.reset_password_within = 3.hours
 
   # When set to false, does not sign a user in automatically after their password is
   # reset. Defaults to true, so a user is signed in automatically after a reset.