Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

How much time should we give a newly registered user to click the confirmation link sent by email? I can't find any best practise on how long a confirmation link should be valid.

Thanks for sharing your experience.

share|improve this question

4 Answers 4

The expiration time should be the time it takes your system to send the e-mail, plus the time it takes a user to receive and read the e-mail, plus the time it takes a user to click the one-time confirmation link in the e-mail sent to the user, plus the time it takes your system to register the confirmation link. Plus any possible unforseen events at your server and interruptions at the user.

And how long is that? I'd say no more than a couple of hours. But be sure to have a re-send confirmation link e-mail available if something goes terrably wrong during this process.


Reference: Must upvoted answer to the question "How long should an e-mail address confirmation link last and why must it expire at all?" on our sister site Information Security.

share|improve this answer

I've seen confirmation mails that decay and die over 2 hours and I've personally clicked on confirmation mails 4 months after their date of delivery and found them to be valid.

Essentially - you should pick your decay algorithm (which determines when the validity is up) or formula based on the type of confirmation i.e. if its critical, casual or just a e-mail ownership check. Critical events call for a faster decay, while casual and email ownership checks can decay over a long duration or just not decay at all.

Critical examples

  1. If your confirmation is to prevent or detect hacking or unauthorized entries into an account
  2. If your confirmation is an OTP (One Time Password) or authentication codes

Casual examples -

  1. Account registration & e-mail activation
  2. validating e-mail for posting rights etc.

In most cases, 12 ~ 24 hrs is popular because of time zones. But you'll have to do your user research to determine the best number for your application. I would consult a security engineer.

share|improve this answer
    
? OTP ?........ –  Marjan Venema Jan 8 at 7:28
    
@MarjanVenema One-Time Password :) –  Benny Skogberg Jan 8 at 10:34
1  
My bad, I assumed it was a famous term. Added the abbreviation in my post. –  Rayraegah Jan 8 at 11:03
    
@Rayraegah OTP makes me think of the older crypto term. But I suppose that would kinda work in this context anyway. –  Bob Jan 9 at 4:02

How much time should we give a newly registered user to click the confirmation link sent by email?

You won't find one answer to this question as every organization and registration process has its own context and demands. Let me rephrase the question and see what comes up.

  • Why is it important to make a hyperlink invalid? If your answer is system-concerns including security, then it is systems' need and must not take precedence over human needs.
  • How much value (customer/financial/primary/secondary objectives) would be compromised once a link becomes invalid vs how much would you gain as a result? Cost-Benefit Analysis.
  • How often would your customer base check their emails? If I am dealing with senior audience, for them email checking would be less frequent than tribes who live online.

I don't understand your context of use but my general expression is that the link should remain valid as long as possible, keeping it active for several days at least. You can learn from GoDaddy and Udemy's promotional emails carrying discount coupons. Their emails stay valid for 3+ days because they know even when user has direct benefit in using this coupon, they will still take considerable time to find the empty time-slot and be able to make use of it.

share|improve this answer

The duration of validity completely depends on the kind of application for which the confirmation link is used for. If it's a security application or some application where being human or a bot is a critical factor then you can keep the duration as low as 2 hours or maybe if the application is fun and not really very security critical then it can be 8 hours. But according to me, it shouldn't be anywhere more than 24 hours.

Just make sure the link is received by the user within 24 hours of signing up. Sometimes, I have received it after 48 hours.

share|improve this answer
3  
You say 24 hours according to you, but why do you pick that value? –  JonW Jan 7 at 16:13
    
@JonW 24 hours was just an estimate from my side because usually a day is the utmost duration where the system can wait for the user to get back. But as I said it can be as low as 2 hours. I feel that a security engineer might be a better help here. –  Dhananjay Garg Jan 8 at 18:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.