If a user has forgotten their password for a service, the convention is that they should need only their username and/or registered email address in order to reset their password -- in our case that means have a new, randomly generated one sent to them.

But, shouldn't services require a confirmation (such as emailing a link to the user) before sending out a new password, in order to verify that it is the owner of the account requesting the password reset?

Usernames are often public information, and email addresses are easily guessed if you have enough information about a person. Without a confirmation, it would be very easy for someone that is not the account owner to reset someone's password for them, which would be a nuisance.

I have seen web services seek confirmation first, and others that simply throw out a new password, regardless of who requested it.

Should we require a confirmation before resetting a password? Are those that don't require a confirmation doing it for a valid, user-friendly reason? Or are they just lazy?


2 Answers 2


The optimal way to do this is to have your "reset password" feature send an email, which satisfies your "confirm their intent" objective, but instead of that confirmation sending a second email with a new password (security no-no), have the confirmation link take them to a form only accessible from the link in that email; the URL/query string to access this form should expire for security reasons.

Once the user click the link, they should get a form on your website which has two password fields to set themself a new password right there:


download bmml source – Wireframes created with Balsamiq Mockups

The form should have your proper branding/styling and an HTTPS connection to invoke trust (and security). For added security you can send a one-use, time limited code to the user's phone/email to be entered along with the new password, stuff like this is common in more secure apps to prevent access if you've only stolen someone's email/username.


In my opinion, yes you should.

I would allow someone to request a password reset, email the account holder to say "we have received a reset request, if you want to reset your password, click this link..." and when that link is clicked, the new password is generated and sent to them (and perhaps they end up logged in as part of that process, so they can go and change the password straight away)

I'd also have some sort of throttle to that, so nobody can spam password reset requests.

Edit: The above was directed at sites that force passwords on their users. A slight alternative would be after logging the user in after they click the link in the password reset email, you then present them with a form to request input a new password before they can go any further.

  • I agree. I was just wondering if those that didn't knew something I didn't. We're gonna require the confirmation (an email a user can simply ignore if they didn't request it, without any consequences). Good point about the throttle.
    – Edd Morgan
    Aug 3, 2012 at 13:53
  • I don't know exactly why some sites don't do things like this, and I can't say I've ever had someone reset my password for me (not that I've known about!) I assume it's just developers not thinking too hard about the user in those cases. Also it might just depend on how busy the site is and how likely it is that you'll have visitors that might want to annoy other users by triggering lots of password resets.
    – Treborbob
    Aug 3, 2012 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.