Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

I'm working on a financially leaning site and was curious — is there a standard amount of time to wait before expiring a reset password link once a user has forgotten his/hers and requested to reset it?

On the other hand, if there is no "standard" as such, how might a UX practitioner go about figuring out what would be a sensible and acceptable period for their use case?

share|improve this question
1  
This may be a duplicate post I think. Does this post answer any of your queries? ux.stackexchange.com/questions/42007/… –  JonW Nov 6 '13 at 15:24
    
That Q has 4 answers addressing the 'why', none addressing the 'how much' of this question. –  Erics Nov 6 '13 at 16:33

2 Answers 2

Generally when users initiate a password reset, they're actively in the process of trying to get into their account. I would set the link expiration between 30-60 minutes, and insert a message letting the user know when the link will expire and have instructions on how they can re-engage the process again if they need a new link.

However there is an approach where you could use a generic forgot password link for all users and wouldn't need to worry about link expiration at all. Since there are some security issues that arise when you provide a user specific link, you could have all users visit a forgot password page where they have to answer specific challenge and security questions before proceeding to the password reset screen. With this method you reduce the risk of a user's account being compromised if that same user's email account has also been compromised. This approach is outlined in this PDF file.

share|improve this answer

I think 24 hours is a user-friendly (ie, convenient) time limit. It's easy to remember if you're the requesting party and it gives you plenty of time.

share|improve this answer
    
This answer expresses an opinion when the question asks for a standard. –  James Jenkins Nov 6 '13 at 19:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.