Call the account secret a "password" in the English copy

[zattak1]

The login and activation flow calls the account secret a "pass phrase". For a first-time user that term either means nothing or — in an app whose login dialog can also show a Connect Wallet button — reads as a seed phrase, at exactly the moment they are deciding whether to trust the app with an account.

The markup already takes the other side of this. The inputs are type="password", id="current-password" / "new-password", class="Q_password", autocomplete="new-password". Only the visible copy still says "pass phrase", so this makes the strings agree with the fields they label.

Scope

Renamed at every English site, because a partial rename is worse than none — the dialog saying "password" while the activation page two minutes later says "pass phrase" is two names for one thing.

File	What changed
text/Users/content/en.json	activate/ChoosePassPhrase(+SeeSuggestions), notifications/ForgetPass, PassphraseSaved, login/passphrase, resend*, noPassphrase, notVerified, setIdentifier/sendMessage
text/Users/email/en.json	activation/ReallyYourEmail, resend/Subject, YouAreReceiving, Reset, SetUpPassphrase
text/Users/mobile/en.json	resend/DidYouWant
web/js/Users.js	the JS defaults that render before Q.Text.get resolves — both mirrors have to agree, or the copy visibly changes as the fetch lands
views/Users/content/activate.php	the input placeholder
views/Users/email/resend.php	the example email
classes/Users/Exception/WrongPassphrase.php	the wrong-login message
classes/Users/Email.php	the hardcoded fallback subject in resendActivationMessage()

Two strings rewritten rather than word-swapped

Both named an action the user has no model for ("send yourself an activation message"):

• notVerified → "Your account is not verified yet. We will send you a link to finish setting it up."
• noPassphrase → "You have not set a password yet. We will send you a link to set one."

The resend strings say "we sent you a link" rather than naming email, since the identifier can be a mobile number and the same concepts render through the SMS views.

What is deliberately not touched

Values only. Keys (ChoosePassPhrase, SetUpPassphrase, noPassphrase, DidYouWant), config paths, event names, class names, request field names (passphrase, passphrase_hashed) and column names (passphraseHash) are unchanged — they are API surface, and renaming them would break consumers for a cosmetic win. So this is copy-only: no behavior, no schema, no wire format.

Non-English locale files are left alone; retranslating them is a separate change for someone who speaks each language.

Note

This is a terminology/product-opinion change, so it is entirely reasonable to decline it — happy to close if "pass phrase" is a deliberate choice. We are carrying it on our fork either way; opening it here in case it is useful upstream.