Password reset emails: how to make them secure and make them arrive

Make the link safe

• Make it expire. 15 to 60 minutes is plenty. The longer a link lives, the longer an old email sitting in an inbox is a way into the account.
• Make it work once. After it is used, or after a newer one is requested, the old link must fail.
• Use a long random token from a secure generator, and store only a hash of it, as you would a password. If your database leaks, the leaked rows should not be usable links.
• Use a button that goes to a page, then a form. Some mail scanners open every link in a message. If opening the link itself resets the password or signs someone in, a scanner can use the token up before the person does.
• Sign everyone out when the password changes, and send a second email saying it happened, with a way to report it.

Do not reveal who has an account

If your form says “no account with that email”, anyone can use it to find out who is a customer. Give the same answer either way: “If there is an account for that address, we have sent a link.” Send the email only when there is one, and take the same time to answer in both cases.

Also limit how many reset emails one address can get per hour. Otherwise your form can be used to flood someone’s inbox, and your domain pays the reputation cost.

Write it so people finish

• The subject says what it is: “Reset your password”. No cleverness, no company slogan.
• One button, and the link again as plain text underneath, for clients that strip buttons.
• Say how long the link works, and what to do if they did not ask: “You can ignore this email, and your password stays the same.”
• If you have it, show where the request came from (a rough place, the browser). It helps someone spot a request that was not theirs.
• Never put the new password, or the old one, in the email.

Make it arrive

Reset emails are the most time-sensitive mail you send, so they need the most care. Send them from an authenticated subdomain, separate from your marketing mail. Include a plain-text part. Turn click tracking off for these links: tracking rewrites the address through another domain, which can break the token and looks like phishing to some filters.

Then watch them. If resets are slow or missing, people blame your product, not their inbox. Spam problems usually show up first as support tickets saying “I never got the email”.

Start from a template

You do not have to write this from scratch. There are ready-made, free password reset, password changed and new sign-in alert templates in the template gallery. Add one to your project, put your logo on it, and send it by its id.