I work in a company that has four mobile apps. Those apps have an iOS and an Android version.

Also, we have the main website.

Having registered, users can log in to the main website or any of the apps. They can also retrieve the password both on the main website or in the apps.

Right now, our password recovery workflow asks the user's email and then (if a user with the entered email is found) sends an email with a recovery link. This recovery email can be used just one time and has an expiration time of 24 hours.

The problems that we are facing are, for example:

  • users don't receive the email,
  • users receive it but it lands in spam,
  • users click the link in email after it has expired,
  • users receive the email, click the link, which opens in a mobile browser, they change the password, but then forget to use it to log into the app,
  • etc.

I would like to know if there are any "new" password recovery workflows. For example, sending a push notification with a pin code, or sending a deep link to the app in the password recovery email, etc.

Any idea would be appreciated.

Thanks in advance.

  • Sounds like to me that you're not being descriptive to your users. If you are sending the email that has the rest link, you should tell them in the email that this expires in 24 hours, and even if they click it after the 24 hour mark, you should tell them that it has expired already. Do you have any designs that will help us help you?
    – UXerUIer
    Commented Apr 19, 2017 at 14:46

3 Answers 3


I think that changing the whole password recovery system may be a lot of work, so I would suggest adding some quick fixes to the problems you have pointed out.

Users don't receive the email

This may be due to several circumstances:

  • a typo in while providing the email during the password reset process – you can address it by adding an email syntax validation,

  • they may have used another email address than the one used during the registration – you have two ways to address this problem: first would be checking if an account with this email exists, and giving User the information if it has not been found in the system – however, this leads to security and privacy flaw, so in many cases it is not the best way to go. The second option would be to at least give them this kind of information on the password recovery screen:

Not received the recovery link?

You may have used another address during the registration. [Try another address]

Users receive it but it lands in spam

This is something that you should probably approach from two sides:

  • check your mail server credibility – use a certificate to sign the emails and so on,
  • tell your Users to check the spam folder – this would be topping-up the previously mentioned message with additional information:

Not received the recovery link?

  1. Check your spam folder.

  2. You may have used another address during the registration. [Try another address]

Users click the link in email after it has expired

You can easily fix this one, with an information in the page the link leads to saying:

This password reset link has expired. Would you like to send another one?

[Resend the password reset link]

I believe User would not need to enter the email again.

Users receive the email, click the link, which opens in a mobile browser, they change the password, but then forget to use it to log into the app

Two solutions here:

  • as you mentioned, deep linking to the app would be a good solution, and it could either regard the password reset link that would be done in the app or you could redirect the User to the app after they perform the password reset – the link would need to include a token that would automatically log them in.

  • an easier, yet less effective way, would be to inform Users that they will need to log in to the app. You can do this either before they start the password recovery process, or on the "set new password" screen, or on the screen that appears after the new password is set:

You have successfully reset your password

Use it to log in to the apps or the website.


Sending an email with the password reset link is the resource most used by companies, but Google, Yahoo, and others also use other forms of password recovery, such as sending the password by message on the cell phone or answering a Series of personal questions.

I believe that the best way to do this is to make more than one option available to the user, this facilitates user password recovery.

If you are interested, enter "Forgot password?" Google and Yahoo to be inspired.

In this link you have some tips to use too: https://uxplanet.org/most-common-log-in-problems-and-solutions-163a6209c0eb


Another method would be sending a temporary password. The system shall generate a temporary password and send it to registered email and prompt user to enter that temporary password in the password field of the login screen, after which user is re-directed to change password screen.

  • @FreelanceAr stated quite a few problems with sending emails. Your answer would improve a lot if you addressed those problems. Commented Jun 20, 2018 at 10:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.