How to tell the user email already exists and if that email address belongs to you then reset the password

Question

I need to show a message to the user if the user tries to create an account and that email address already is taken and if that email address belongs to the user then reset the password for the account associated with that email address.

There might be some case this could happen.

• User creates an account before and forgot that
• Someone has uses there an email address to create an account

Answer 1

I don't know if there's a best practice; for a 'reset password' form, best practice from a security perspective is not letting the user know whether the email address actually exists, i.e. something along the lines of "If an account with this email address exists, you'll receive an email with the reset link."

You could do it the way this site does it (best tested by opening a private window and trying to sign up with the email address you used for your own account). If it exists, you'll simply see the message

Forgot your account’s password? Enter your email address and we’ll send you a recovery link.

I guess this option is rate-limited (with captchas and such) in order to prevent people from trying out a lot of email addresses harvested somewhere else.

Answer 2

I think you should say: "This email is already associated with an account." in red( or warning color).

With this, you can display buttons( or link) to Forget Password window.