This is "inspired" (a crosspost?) by this question I asked on StackOverflow Meta: to my surprise it has been highly downvoted, so I'm asking here to you experts, if my "feel" is sharable or not.

Basically, this is what you see when you want to login to StackOverflow:

enter image description here

And this the page you are redirected on when you click on the "Forgot password" link, regardless of if and what you have typed in the Email field in the first page

enter image description here

My suggestion is that "Forgot password?" should be clickable only if something has been typed into the email address field, and should immediately send a recovery email to that address: no need for the second page at all.

So, the question(s):

  1. My feeling is that asking twice the email address is wrong. Am I right?
  2. I believe the current implementation does not reflect the typical use case, that (I believe) is: try a bunch of passwords, give up, click on the link. Is it so?
  3. Can the current implementation be improved?
  • I'm not certain it should immediately send out the recovery email, at a minimum I think there should be user-confirmation to deal with accidental clicks. However, if a new pop-up is shown, then definitely any email address already entered should be pre-populated in it.
    – TripeHound
    Commented Apr 24, 2019 at 9:45

1 Answer 1


TL;DR - No, it's not a bad idea to allow the user to click on the forgot password link and it isn't a good idea to directly send out an email

Here's why:

Should the user be allowed to click on the "Forgot Password?" link without typing in their login id or before a failed attempt at logging in?

Yes! Of course! Refer to my answer here for the scenario. In short, it is needed because a user might not be comfortable entering a wrong/forgotten password because there's a potential chance of it locking the account.

Should there be a "Forgot Password?" screen OR should "Forgot Password?" flow be a multi-step process?

Yes, absolutely. In a lot of websites, people use a login id/alias as the login credential rather than the email itself. You can't presume that all the login ids are going to be emails.

Also, "Forgot Password?" doesn't convey what would happen if you clicked on it. If clicking that link performs an action directly, most users would find it confusing. The reason being, there could multiple ways of recovering a password.

Also also, what if the "recovery email id" isn't in use anymore? Like I mentioned before, there could be multiple ways of recovering/resetting a password these days. Navigating to a screen that allows the user to choose their preferred method is simple a good practice.

A side note - Never question a design pattern because it doesn't fit your particular needs/feelings. An application always has to take ALL users into consideration and pick an inclusive pattern.

  • Agree with most of what you say, but if you are using your email address as the "login id", and you have already typed it in (and then either realised you can't remember the password or the password was wrong), then on clicking "Forgotten password?" link, I think that should be pre-filled in the "Recover password" pop-up/screen.
    – TripeHound
    Commented Apr 24, 2019 at 11:03
  • Yes, absolutely. Makes sense to pre-fill it Commented Apr 24, 2019 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.