@Gargron afaicr you put your old password in and then it decrypts all the stuff with it and then uses the new password to encrypt it all.

Which is why if you completely lose your password, the old content pre-reset stays encrypted and you can't read it unless you somehow remember the old password.