diff --git a/app/Http/Controllers/AuthController.php b/app/Http/Controllers/AuthController.php
index fed1aea..6ab2d0e 100644
--- a/app/Http/Controllers/AuthController.php
+++ b/app/Http/Controllers/AuthController.php
@@ -3,15 +3,22 @@ namespace App\Http\Controllers;
 use Illuminate\Http\Request;
 use App\User;
 use App\UserVerification;
+use App\PasswordResets;
 use JWTAuth;
 use Auth;
 use Aloha\Twilio\Twilio;
 use Tymon\JWTAuth\Exceptions\JWTException;
 use Validator, DB, Hash, Mail, Illuminate\Support\Facades\Password;
 use Illuminate\Auth\Passwords\TokenRepositoryInterface;
+use Illuminate\Contracts\Hashing\Hasher as HasherContract;
 
 class AuthController extends Controller
 {
+    protected $hasher;
+    public function __construct(HasherContract $hasher)
+    {
+        $this->hasher = $hasher;
+    }
     /**
      * API Send verification code 
      *
@@ -133,7 +140,7 @@ class AuthController extends Controller
         $credentials = $request->only('phone', 'password');
         
         $rules = [
-            'phone' => 'required|digits:10|unique:users',
+            'phone' => 'required|digits:11',
             'password' => 'required',
         ];
         $validator = Validator::make($credentials, $rules);
@@ -183,6 +190,18 @@ class AuthController extends Controller
      */
     public function recover(Request $request)
     {
+                
+        $credentials = $request->only('phone');
+
+        $rules = [
+            'phone'=> 'required',
+        ];
+
+        $validator = Validator::make($credentials, $rules);
+        if($validator->fails()) {
+            return response()->json(['success'=> false, 'error'=> $validator->messages()]);
+        }
+
         $user = User::where('phone', $request->phone)->first();
 
         if ($user){
@@ -191,6 +210,9 @@ class AuthController extends Controller
                 'phone' => $user->phone, 
                 'token' => $token
             ]);
+            return response()->json([
+                'success' => true, 'data'=> ['message'=> 'A reset link has been send to your mobile phone.']
+            ]);
         }
 
         /*
@@ -200,8 +222,44 @@ class AuthController extends Controller
         */
 
         return response()->json([
-            'success' => true, 'data'=> ['message'=> 'A reset link has been send to your mobile phone.']
+            'success' => false, 'data'=> ['message'=> 'Fail to recover your account.']
         ]);
     }
 
+    /**
+     * Reset the given user's password.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return \Illuminate\Http\Response
+     */
+    public function reset(Request $request)
+    {
+        
+        $credentials = $request->only('token', 'password', 'password_confirmation');
+
+        $rules = [
+            'token' => 'required',
+            'password' => 'required|confirmed|min:6'
+        ];
+
+        $validator = Validator::make($credentials, $rules);
+        if($validator->fails()) {
+            return response()->json(['success'=> false, 'error'=> $validator->messages()]);
+        }
+        $token = $request->get('token');
+        $password = $request->get('password');
+        $reset = PasswordResets::where('token', $token)->first();
+        if($reset) {
+            $user = User::where('phone', '=', $reset->phone)->first();
+            $user->password = Hash::make($password);
+            $user->save();
+            $reset->delete();
+            return response()->json([
+                'success' => false, 'data'=> ['message'=> 'Reset success']
+            ]);
+        }
+        return response()->json([
+            'success' => false, 'data'=> ['message'=> 'Invalid token or email or expired code']
+        ]);
+    }
 }
\ No newline at end of file
diff --git a/app/Http/Controllers/ForgotPasswordController.php b/app/Http/Controllers/ForgotPasswordController.php
new file mode 100644
index 0000000..ba5fb2d
--- /dev/null
+++ b/app/Http/Controllers/ForgotPasswordController.php
@@ -0,0 +1,10 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use Illuminate\Http\Request;
+
+class ForgotPasswordController extends Controller
+{
+    //
+}
diff --git a/app/PasswordResets.php b/app/PasswordResets.php
new file mode 100644
index 0000000..ee4f91b
--- /dev/null
+++ b/app/PasswordResets.php
@@ -0,0 +1,10 @@
+<?php
+
+namespace App;
+
+use Illuminate\Database\Eloquent\Model;
+
+class PasswordResets extends Model
+{
+    //
+}
diff --git a/database/migrations/2018_04_27_021807_add_id_to_password_reset.php b/database/migrations/2018_04_27_021807_add_id_to_password_reset.php
new file mode 100644
index 0000000..c5a2e68
--- /dev/null
+++ b/database/migrations/2018_04_27_021807_add_id_to_password_reset.php
@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Database\Migrations\Migration;
+
+class AddIdToPasswordReset extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        Schema::table('password_resets', function (Blueprint $table) {
+            $table->increments('id');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        //
+    }
+}
diff --git a/routes/api.php b/routes/api.php
index 8bb5c98..b606f28 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -20,6 +20,7 @@ use Illuminate\Http\Request;
 Route::post('register', 'AuthController@register');
 Route::post('login', 'AuthController@login');
 Route::post('password/recover', 'AuthController@recover');
+Route::post('password/reset', 'AuthController@reset');
 
 
 Route::post('send-verification', 'AuthController@sendVerification');