diff --git a/include/class-Mailbox.php b/include/class-Mailbox.php
index 8e9a171..55895b0 100644
--- a/include/class-Mailbox.php
+++ b/include/class-Mailbox.php
@@ -1,108 +1,110 @@
 <?php
 # Copyright (C) 2018 Valerio Bozzolan
 # Boz Libre Hosting Panel
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as
 # published by the Free Software Foundation, either version 3 of the
 # License, or (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU Affero General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
 
 /**
  * A mailbox
  */
 class Mailbox extends Domain {
 
 	const T = 'mailbox';
 
 	public function __construct() {
 		$this->booleans( 'mailbox_receive' );
 	}
 
 	/**
 	 * Get the mailbox username
 	 *
 	 * @return string
 	 */
 	public function getMailboxUsername() {
 		return $this->get( 'mailbox_username' );
 	}
 
 	/**
 	 * Get the mailbox address
 	 *
 	 * @return string E-mail
 	 */
 	public function getMailboxAddress() {
 		return sprintf( "%s@%s",
 			$this->get( 'mailbox_username' ),
 			$this->get( 'domain_name' )
 		);
 	}
 
 	/**
 	 * Get the mailbox permalink
 	 *
 	 * @return string
 	 */
 	public function getMailboxPermalink( $absolute = false ) {
 		return Mailbox::permalink(
 			$this->get( 'domain_name' ),
 			$this->get( 'mailbox_username' )
 		);
 	}
 
 	/**
 	 * Update this mailbox password
 	 *
-	 * @param $password string
+	 * @param  string $password
 	 * @return string
 	 */
 	public function updateMailboxPassword( $password = null ) {
 		if( ! $password ) {
 			$password = generate_password();
 		}
+
 		$enc_password = Mailbox::encryptPassword( $password );
-		query_update( 'mailbox', [
-			new DBCol( 'mailbox_password', $enc_password, 's' ),
-		], sprintf(
-			"domain_ID = %d AND mailbox_username = '%s'",
-			$this->getDomainID(),
-			esc_sql( $this->get( 'mailbox_username' ) )
-		) );
+
+		// update
+		( new MailboxAPI() )
+			->whereMailbox( $this )
+			->update( [
+				new DBCol( 'mailbox_password', $enc_password, 's' ),
+			] );
+
 		return $password;
 	}
 
 	/**
 	 * Get the mailbox permalink
 	 *
 	 * @param $domain string
 	 * @param $mailbox string
 	 * @param $absolute boolean
 	 * @return string
 	 */
 	public static function permalink( $domain, $mailbox = null, $absolute = false ) {
 		$part = site_page( 'mailbox.php', $absolute ) . _ . $domain;
 		if( $mailbox ) {
 			$part .= _ . $mailbox;
 		}
 		return $part;
 	}
 
 	/**
 	 * Encrypt a password
 	 *
 	 * TODO: do not hardcode to my Dovecot configuration
 	 */
 	public static function encryptPassword( $password ) {
 		$salt = bin2hex( openssl_random_pseudo_bytes( 3 ) );
 		return '{SHA512-CRYPT}' . crypt( $password, "$6$$salt" );
 	}
 }
diff --git a/include/class-MailboxAPI.php b/include/class-MailboxAPI.php
index 822fa2a..d50d470 100644
--- a/include/class-MailboxAPI.php
+++ b/include/class-MailboxAPI.php
@@ -1,64 +1,85 @@
 <?php
 # Copyright (C) 2018, 2019 Valerio Bozzolan
 # Boz Libre Hosting Panel
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as
 # published by the Free Software Foundation, either version 3 of the
 # License, or (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU Affero General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
 
 /**
  * Mailbox API
  */
 class MailboxAPI extends DomainAPI {
 
 	public function __construct() {
 		Query::__construct();
 		$this->from( Mailbox::T );
 		$this->defaultClass( 'Mailbox' );
 	}
 
+	/**
+	 * Limit to a specific mailbox
+	 *
+	 * @param  object $mailbox Mailbox
+	 * @return self
+	 */
+	public function whereMailbox( $mailbox ) {
+		return $this->whereDomain( $mailbox )
+		            ->whereMaiboxUsername( $mailbox->getMailboxUsername() );
+	}
+
+	/**
+	 * Filter a specific Mailbox username
+	 *
+	 * @param  string $username Mailbox username (without domain name)
+	 * @return self
+	 */
+	public function whereMailboxUsername( $username ) {
+		return $this->whereStr( Mailbox::USERNAME, $username );
+	}
+
 	/**
 	 * Where the Mailbox is Active (or not)
 	 *
 	 * @param  boolean $active If you want the active, or the inactive
 	 * @return self
 	 */
 	public function whereMailboxIsActive( $active = true ) {
 		return $this->wheerInt( 'mailbox_active', $active );
 	}
 
 	/**
 	 * Join mailboxes and domain (once)
 	 *
 	 * @return self
 	 */
 	public function joinMailboxDomain() {
 		if( empty( $this->joinedMailboxDomain ) ) {
 			$this->from( 'domain' );
 			$this->equals( 'domain.domain_ID', 'mailbox.domain_ID' );
 
 			$this->joinedMailboxDomain = true;
 		}
 		return $this;
 	}
 
 	/**
 	 * Check if I can edit this mailbox
 	 *
 	 * Actually it just checks if you can edit the whole domain.
 	 *
 	 * @return boolean
 	 */
 	public function whereMailboxIsEditable() {
 		return $this->whereDomainIsEditable();
 	}
 }
diff --git a/template/mailbox.php b/template/mailbox.php
index 6e85f6f..e0a0a66 100644
--- a/template/mailbox.php
+++ b/template/mailbox.php
@@ -1,68 +1,69 @@
 <?php
 # Copyright (C) 2018, 2019 Valerio Bozzolan
 # Boz Libre Hosting Panel
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as
 # published by the Free Software Foundation, either version 3 of the
 # License, or (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU Affero General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
 
 /*
  * This is the template for a mailbox
  *
  * Called from:
  * 	mailbox.php
  *
  * Available variables:
  * 	$mailbox object
  * 	$domain  object
  * 	$mailbox_password string|null
  */
 
 // unuseful when load directly
 defined( 'BOZ_PHP' ) or die;
 ?>
 
 	<?php template( 'mailbox-description' ) ?>
 
 	<!-- resources -->
 	<?php if( $mailbox ): ?>
 		<h3><?= __( "Resources" ) ?></h3>
 		<ul>
 			<li>
 				<a href="https://mail.reyboz.it?email=<?= urlencode( $mailbox->getMailboxAddress() ) ?>" target="_blank" />
 					<?= __( "How to setup your IMAP/SMTP client" ) ?>
 				</a>
 			</li>
 		</ul>
 	<?php endif ?>
 	<!-- /resources -->
 
 	<?php if( $mailbox ): ?>
 		<h3><?= __( "Actions" ) ?></h3>
 		<form method="post">
+			<?php form_action( 'mailbox-password-reset' ) ?>
 			<?php if( $mailbox_password ): ?>
 				<label for="password"><?= __( "Please copy your new password:" ) ?><br />
 				<input type="text" id="password" readonly<?= value( $mailbox_password ) ?> />
 			<?php else: ?>
-				<p><button type="submit" class="btn btn-default" name="action" value="mailbox-password-reset"><?= __( "Generate new password" ) ?></button></p>
+				<p><button type="submit" class="btn btn-default"><?= __( "Generate new password" ) ?></button></p>
 			<?php endif ?>
 		</form>
 	<?php else: ?>
 		<form method="post">
 			<?php form_action( 'mailbox-create' ) ?>
 			<p><label for="mailbox-username"><?= __( "Mailbox name:" ) ?></label><br />
 				<input type="text" name="mailbox_username" id="mailbox-username" length="64" /> @ <?= esc_html( $domain->getDomainName() ) ?>
 			</p>
 			<p><button type="submit" class="btn btn-default"><?= __( "Create" ) ?></button></p>
 		</form>
 	<?php endif ?>
 	<!-- /actions -->