The convention for forgotten passwords seems to have stranded on the following:

  1. Click a link under the Password input field saying "Forgot password"
  2. Enter your email address and click "Send password"
  3. Click the link in the email to create a new password.

I'm trying to think of a way to lose the "Forgot password" link. My ideas so far are:

  • A) If the user logs in with the incorrect password, send him the reset password link.
  • B) If the user logs in with no password, send him the reset password link.

The problem with A is that the user will get some unnecessary emails, if he just needs a few attempts at remembering his password by heart.

The problem with B is that you have to tell the user to leave out the password. And that quickly takes up more space than the "Forgot password" link.

(You could say after the first login failure: "Leave password field blank to create a new password". But would most people make at least one attempt at logging in before realizing they don't remember their password, or are their minds just blank from the start so they won't even have a go at it?)

Are we stuck with the "Forgot password" link, or can anyone come up with a better solution?

EDIT: The original post actually said "send password", whereas I obviously meant "send reset password link". How embarrassing :)

  • So if I know that my spouse signed up somewhere with his normal e-mail address, I could simply enter an invalid or blank password and you would send me a new password so I can impersonate him? Please bear in mind that not all e-mail addresses are used by a single person... Commented Aug 12, 2013 at 19:31
  • 1
    @MarjanVenema You can already do all of that now. What's preventing you from going to a site and starting the forgot password process? E-mail addresses are used in sites as a unique identifier. If your husband gave you access and you do something malicious, that's on him/you. I'm not going to start worrying about a wife impersonating their husband on the websites that I create. Commented Aug 12, 2013 at 20:56
  • 1
    @MiniRagnarok: true, but most "forgotten password" flows do NOT send out a password, they send out a link that expires pretty quickly. Sending out passwords in e-mail is a definite security hole. And my point was more that you are making it way too easy and are making sending out a password a possibly unintended effect: people do forget to enter their password when logging in and are prompted to do so only by the fact that they don't get in. Commented Aug 13, 2013 at 7:24
  • 1
    Sending out passwords in emails unencrypted is a bad security flaw; a good 'Forgot Password' system is designed to keep high security. Commented Aug 13, 2013 at 10:11
  • 1
    For the record: My original posting was about emailing the user a "reset password" link, not the verbatim password.
    – forthrin
    Commented Aug 13, 2013 at 11:30

5 Answers 5


I can't see what is the goal here? To get rid of "forgot password" link? It is easy - make it visible only if the user enters incorrect password at least once.

The "forgot password" link is what the user knows and expects. Don't try to astonish him.

  • 3
    The goal being to simplify and challenge the established. Which is how the world evolves.
    – forthrin
    Commented Aug 12, 2013 at 21:03
  • 5
    "Make it visible only if the user enters incorrect password at least once." -- that will still create "astonishment" for those users who have truly forgotten their password. They will not see a link and it will be counter-intuitive to try to sign in by making up a password. Hence, they will be stuck.
    – Erion
    Commented Aug 13, 2013 at 9:37
  • @Erion - you are probably right. But on the other hand, what "forgot their password" means? It always worths to try one, two times to remember. Who can say "I can't remember my password for sure" without trying to remember?
    – johnfound
    Commented Aug 13, 2013 at 10:19
  • 3
    Who? You'd be, let's say, astonished to learn that users hate trying to guess passwords they don't remember. Commented Aug 13, 2013 at 16:54

For starters, both of your solutions are bound for abuse. Anyone that knows your username could try to impersonate you and get your application to send a whole bunch of unsolicited emails. That means your users will think you're annoying and at this point they're less likely to use your application. Obviously, that's not good.

Unfortunately, us humans, in addition to our nefarious tendencies, forget things and passwords are probably one of the things we forget the most.

To answer your question, yes we are stuck with the "forgot my password" link. However, the issue doesn't really lie there, but rather in the complexity of said passwords. There is a very interesting answer that revolves around this idea on StackOverflow. Here's an important tidbit:

a passphrase with about 77 bits of entropy: "admit prose flare table acute flair"

a password with about 74 bits of entropy: "K:&$R^tt~qkD"

  • They could send unsolicited emails using a regular "Forgot password" form too. Unless your point is something else?
    – forthrin
    Commented Aug 12, 2013 at 19:17
  • Yes, of course, but it "streamlines" the abuse process. Commented Aug 12, 2013 at 19:20

Two ideas, I haven't implemented them, nor have they seen scrutinity.

Get rid of the password

"Forgot password?" already binds your identity by access to your inbox. So instead of getting rid of the "forgot password" email, get rid of the password itself.

The forgot password e-mail could do the following:

Click here to set a new password
Click here to log me in

Clicking the second link could redirect you to the site, reset your password and set your session to "logged in", skipping the step of entering a password twice that you will tell me is insufficient anyway and I will forget within minutes.

There's a lot to do to make it work well, but nothing out of the ordinary:

  • the link sent should expire (no old links letting you log in)
  • measures to prevent spamming vs. impatient users not getting their link fast enough (you need to allow multiple pending "log me in" links)
  • consider how long this login should last - session? A day? A week?
  • An explicit logout should also invalidate the link

The heightened risk is a more frequent e-mail communication (without cookies, every time you log in) which could be captured. Plus user is more dependent on a 3rd party utility - email - for access to your site. That's icnremental, not completely new, however.


Let the user download a permanent "log me in" file. (e.g. a plain HTML file containing a form with a "log me in to forthrin.com" button, submitting the login ID over https://).

Access to the site would now require access to the user desktop where this file is stored, something that most users would at least be comfortable with - or, to put it more bleakly: for most users, access to their desktop means access to their e-mail and/or totallynotmypasswords.txt, which means access to most sites.

A more "physical" token like this might be more convenient in user perception, though.


Some thoughts conserning your scenarios.
A) If the user logs in with the incorrect password, send him the password
User could enter correct password from second or third try, iterating through his passwords or correcting keyboard layout or caps lock or just correcting typo. So wrong password is not always the sign of need to restore it. More smart behavior is to propose to reset password after several wrong tries.

B) If the user logs in with no password, send him the password
Having an empty field probably majority of users don't guess to submit the form as it is known the password is mandatory. So if several password guessing tries fail, users will search how to restore the password. They will check FAQ, About Us searching for contacts etc.

Just one link "Forgot password" solves this issues. Besides it is familiar way to restore password.


In my mind, much of what we do for security, including passwords, is as much for the mental security of the user as it is for actual security. Whether a system is secure or not, if it makes the user feel secure and gives them peace of mind that can be a good benefit as well.

I like the direction you're thinking on this, but I wonder if it crosses from "helpful" to "creepy" a little bit. "Forgot password" might not be the best, but that familiarity does give a sense of security to most users. That doesn't mean that something like this couldn't be tried, but I'd recommend strong usability studies to make sure that users don't find it creepy. There's a fine line between "creepy" and "helpful."

  • That's why I'm asking the fine people here :)
    – forthrin
    Commented Aug 12, 2013 at 19:17
  • "Whether a system is secure or not, if it makes the user feel secure and gives them peace of mind that can be a good benefit as well."
    – johnfound
    Commented Aug 12, 2013 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.