I am working on a desktop application and when the user requests a password reset link they got it in an email.

Now I am wondering where should I display the content of that reset link (setting new password and so on). If it was a web app - no problem, but here I have a desktop app with a small log in window before it takes the user to the full size app.

Should I take the user to the app's page (although there's no page so far and I'm not sure if there's gonna be) or should I direct them to the new screen on this small window, just display a form to set a new password?

It's just that I think I haven't come across a situation where a reset link does not direct a user to a webpage, but somewhere else and that's why I am a bit confused here.

3 Answers 3


This depends on the perception of usage.

If, in future, you plan to make your application over the web and allow the user to work there as well then redirect the user to a web page and then allow resetting the password there.

If, you only want your application to be a Desktop app, then just open up a small window asking the user to reset the password there.

This is in terms on the UX part.

Now, since you already mentioned that the link is being sent to the user in an email, I think you should redirect the user to a web page since it would be a little consistent in terms of the process flow.

From a development standpoint it would be a bit easier to redirect the users' to a web page to complete this process.

Hope if not the solution, I was able to provide a perspective on it.



When user changes password, you may want to display if the password fits each of your password rules. For instance:

  • Password length mus be at least ... characters
  • Password must contain at least ... digits
  • Password must contain at least ... capital letters

You can indicate (with color, tick mark, etc.) if the new password fits this rule.

That's why your login dialog may be to small and not suitable for password change / reset. That's why I'd recommend to use a separate dialog.


If it is feasible to have a web-app attached to (the back-end of) your desktop app, then sending a "traditional" reset-password link probably involves the least effort on the part of users (although using the browser just to reset the password may be a little strange).

If that's not feasible (i.e. you don't have the opportunity for a web-server to feed updated passwords into the main back-end), then two possibilities come to mind:

Reset Password Code

Have the email include a "reset password code". This would be akin to the long string of random characters contained in a reset-password link and is intended to stop someone randomly resetting another's password.

Have your normal login dialog include an "Enter password reset code" button. This would take them to a new dialog where the user can enter (or, probably, copy/paste) the code from the email before being given the opportunity to specify their new password.

A slight variant could be to allow them to paste the code into the "normal" username field (the email would tell them to do this). So long as the "reset code" cannot be mistaken for a real username, it would take them to the reset-password dialog. This saves having to have an extra button and an extra dialog (where they enter the code).

Register An Application Extension

In Windows, at least, it is possible for a program to "register" an extension (e.g. .docx is often "owned" by Microsoft Word). When you "start" (e.g. by double-clicking) a file with a registered extension, the currently-registered application will be launched.

Your desktop application could register something like .OlaAppPw, and the email could contain a small attachment with this extension (e.g. TripeHound.OlaAppPw). All things being well, double-clicking on the attachment will launch your desktop app, passing in the name of the file. This file can contain the "reset password code" that a web-link would normally contain, and the app can show the reset-password dialog instead of the normal login dialog.

I say "all things being well": some email systems may block, or restrict, users' ability to open attachments with "weird" extensions. Also, many spam/phishing emails contain "Your bank account has been blocked. Open the attachment to reset..." so some users may be averse to doing this (but probably should be equally averse to following a link in an email).

  • Registering an application extension would technically work. But that for user dealing with it would be a poor experience.
    – mentallurg
    Aug 18, 2019 at 1:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.