Password Reset

What is it?

Password reset is the flow that allows users who have forgotten their password to regain access to their account. It is a trust-critical flow — users are anxious (they can't access their account) and rely on the product to help them quickly and securely. Poor design here loses users permanently.

Why it matters

Users who can't access their account are moments away from churning. A fast, simple password reset retains them. A confusing or slow reset drives them to abandon the product. Additionally, password reset security flaws (predictable tokens, no expiry, no confirmation) are a common attack vector.

Best Practices

• Request only email address on the forgot password page — nothing else.
• Send reset link immediately. Response message: "If an account exists with that email, a reset link was sent."
• Reset links must expire after 24 hours maximum. One-time use only.
• Reset link should land on a form with two fields: new password + confirm.
• Show password requirements on the reset form.
• After successful reset: log the user in automatically and redirect to their intended destination.
• Send a security notification email: "Your password was changed on [date] from [location]. If this wasn't you, contact us."
• Limit reset requests to 3–5 per hour per email to prevent abuse.
• Don't expire sessions on password reset for already-logged-in devices (unless a breach is suspected).
• For passwordless products: "magic link" sent to email IS the equivalent of password reset.

Common Mistakes

• Reset confirmation message that reveals account existence: "No account found with that email."
• Reset links that don't expire.
• Multiple-use reset tokens.
• Requiring the user to log in again after resetting — they just proved identity via email.
• No security notification after password change.
• Reset form that clears on error, forcing the user to re-enter both password fields.

Checklist

Research & Theory

Real-World Examples