It's pretty much a fact that users hate having to open a new tab, go to their email service, log in, wait for the email to arrive and then click a link/paste a code.

Is it really necessary to do this though? The only reason I ask for an email address is for if the user has forgotten their password. But, my thinking is, it's up to them if they want to run the risk of not being able to reset their password.

Should I verify their email address, or should I just warn them that should they enter an invalid email then they won't be able to reset their password if they ever lose it?

  • 2
    This question needs more context, there are many situations, from guest checkouts to ordering a driving license online to very human-centric social sites, each of which differs in the way the account email and password reset interaction is defined. Can you tell us what sort of site you are designing? Otherwise I fear the question may well be closed.
    – Toni Leigh
    Commented Nov 17, 2013 at 22:31
  • Judging by the amount of e-mails I get asking me to reset other people's passwords... verification is advisable if you're keeping any sensitive data.
    – dbkk
    Commented Nov 18, 2013 at 18:23

10 Answers 10


We have spent the last months battling with what to do with email confirmation/verification - prior the user had to give all their details at sign up (way too many actually!) but couldn't actually login until they had confirmed their email address by clicking a link.

We stood back and looked at why we did this - three reasons really, one being we wanted users to be able to reset their password etc but also because we wanted to assured of the identity of anyone interacting with our application and this was one small way of doing so. Additionally, we wanted to know the country, industry, employees etc for our clients for marketing reasons but this is flawed as we have literally HUNDREDS of signups for companies called some variation of TEST with 1 employee working in accounting.

The problem we had was emails sometimes don't get delivered - whether it is for technical reasons or simply delays or people entering the wrong email address/typos and this was creating work for our support team but also making a poor first impression for the prospective client.

A few weeks ago we made two major decisions - we now allow clients to signup by just giving us their email address with no requirement for confirmation.

Upon doing so they are immediately logged in (so no waiting) and, in the background, an email is sent asking them to set their password by clicking a link.

This email, in effect, works as a verification email - if they were never serious and were just tyre kicking then they will either have entered a dummy email address or they will never confirm in which case we are no worse off. Indeed by asking for them to create a password we could be better off as only those who are serious and / or like what the application does and looks like etc will actually do so.

If they are serious then they need to create a password to be able to login next time - we are working through more notification within the application to let clients know they need to create their password etc but, as of this morning, we have had ZERO support emails in the last three week raised due to non receipt of signup emails.

There has been a drop in confirmed signups which we expected but this, in itself, is pretty meaningless as previously they would have signed up, kicked the tyres and never logged in again whereas now they signup, kick the tyres and just don't create a password. We need to work through the overall impact in terms of accounts created, number of users and other success metrics etc but, overall, it looks positive.

I still believe we have a need for some sort of email and identity confirmation - the way we now approach it is slightly different to how we did before but it gives the same outcome without being a barrier to the customers initial experience and first impressions and that was what was most important to us.


Just thought I would update this with some stats - we changed our signup process on 28/10/2013. Below are two charts - first one shows confirmed signups (i.e. those who have then gone on to create a password) and the second shows all signups which is more akin to prior data points where all accounts were confirmed before being able to login.

As you can see, there is a drop off in the first chart where almost half of those who signup do not confirm / create a password (this maps to our current stats which shows around that percentage who only login once) and the second chart shows that, at the top end, this has not impacted signups with the number of signups remaining fairly consistent pre and post making the change.

enter image description here

enter image description here

  • 6
    What do you do with unconfirmed sign ups? Are they removed after some period of time?
    – Rob
    Commented Nov 18, 2013 at 15:42
  • Historically, we have just left them in place and, under the new process, we still are having a discussion around how to deal with them. In that first usage after signing up but prior to creating a password, clients can add data to their account and may decide at a later date they want to come back and deleting them could be a problem especially as the "cost" of leaving them in place is minuscule.
    – bhttoan
    Commented Nov 18, 2013 at 15:48
  • 1
    Do you have any compare between new and old confirmation methods about verified signup rates? Did you experienced increase in confirmed signups? Commented Dec 3, 2015 at 6:51
  • 1
    The only issue I can see with this approach is the case where a user creates an account earnestly, accidentally mistypes their email, then adds a lot of content to their account. If that email belongs to someone else, that other person would now have the ability to takeover that account, which might reveal personal information. Has this issue come up for you in practice? Commented Dec 6, 2018 at 2:16
  • 1
    @bhttoan Just wondering, how did this system hold up in the end?
    – Worthy7
    Commented Sep 9, 2019 at 5:28

If you're fine with not having a verified communication channel with your user. Then sure.

But I can't really think of an application where I wouldn't want that. Because not having that verified email means that a forgotten password is the end of the account.

Further there's few things I'd allow that type of unverified user to do that I couldn't just do with a guest that could store its settings in a session/cookie.

There's also simple solution.

Use OpenID. You know, like stackexchange does! Offer several choices and for most users you'll have avoided the annoying email verification step.

More work for you but should (mostly) solve the problem.

  • But without verification, you still can send a forgot password email can't you? If the email was wrong or is of someone else, it's the fault of the user... but mostly it will not be
    – User
    Commented Sep 21, 2015 at 19:29
  • 1
    I was considering the case of an account where someone makes up an email just to try the service out. I should've been more clear. However, you will run into trouble if emails are the unique for every user since one person can claim another person's real email address. And yes, the real email owner could use reset password but then his actions are merged with the actions of the original person (which I certainly wouldnt want if I used the service).
    – jmathew
    Commented Sep 21, 2015 at 20:21
  • Yeah, was thinking about that... the confirmation step is necessary.
    – User
    Commented Sep 21, 2015 at 20:41
  • OpenID is a really good, non-intrusive method.
    – Luca Steeb
    Commented Mar 11, 2016 at 23:17

I dont think that confirming the email address is just about having a communication channel to the user. I think that confirming emails is an absolute must, if not you have to cleanup in order to ensure that no one spoofs existing emails of other users. E.g. someone can register all emails of another user to troll him. Or if he merely mistyped his email, someone else could possibly be able to reset his password, which would I think in return cause more trouble overall than confirming the email address.

  • This is an important point. If your service becomes popular/visible enough some troll is going to write a script to register an account with every email address from "[email protected]" to "[email protected]" just to see if they can, and then what will you do? Commented Dec 7, 2016 at 16:14
  • 1
    That’s what reCaptcha is for.
    – evolross
    Commented Oct 28, 2017 at 22:51

Verifying an email address is less trouble than all the troubles that could happen if not having one for an account. Nobody is going to join your site simply because they don't have to verify their email address.
So you should have them verify it but make it as fast and as easy as possible.

  • "Nobody is going to join your site simply because they don't have to verify their email address" - I'm afraid that's false. There's a distinct reduction in signup completion rate when people are required to switch to an email account as part of the process. Commented Apr 18, 2017 at 10:59
  • 1
    Then to be fair, they don't want your product/service enough
    – Worthy7
    Commented Sep 9, 2019 at 5:22

If you need to do email verification check, don't let that be the show-stoppable for the users to continue interacting with your site, that might just increase the drop-off rate.

Other reasons such as delay in the email sending, email going into user's spam folder, will just add more reasons for them to stop interacting with your site.

As what others have mentioned, any functionalities in the site that required some form of verification first, just alert the user about it. These could include update user profile or relating to any contests that requires personal identification.

Hope this helps.

  • In particular, collectors of email addresses should not send other mail to them until they have been validated. This is simply courtesy for the owner of the email address, which may not be the same person who submitted the address during registration.
    – jacobq
    Commented Jan 29, 2015 at 15:32

I think the previous answers focus way too much on the UX and convenience aspects, either for the user or for the site owners, at the expense of the security aspects.

From a security perspective:

If you don't verify emails, you're giving to just about anyone free reign to register an account on your system with someone else's email address, unbeknownst to them.

This has several impacts:

  • You won't be able to verify they really registered themselves (sure, their email could be hacked but that's generally less likely),
  • You open the door for a lot of manipulation and image/brand damage.
  • You open the door for a lot of fake accounts.

E.g. I register a prime minister's email account to an unsavory site, and can then do whatever I want with that account and show that around. And then media have a field day and a fun news cycle for a while.

On another side of that coin, This is also why NOT letting people know that their email wasn't found in your "recover my password" process is a good thing, or you disclose private information.

If you fail at either of these, you put your users in a possibly tricky position. If you fail at both, it's really bad.

Of course, if you don't want to require email, then you can use another form of verification. And if your authentication system is not name-based, then the image aspects may be less relevant for your use case.

That being said, I see a lot of sites that fail to do this, and it means you can just churn fake accounts like crazy and do a whole lot of bad stuff.

Magic links are a handy alternative, if they are sent to an email, as they allow you to streamline your registration process but keep that verification aspect effective.


I think it is an important precaution for a potentially horrendous UX. A little bother in advance to prevent a lot of potential problems in the future. However, the way to make this not bother your users too much is to remove the need for them to do it right away.

If possible, let the users sign up and engage with the system, and then the next time they're on their email, they'll see a clear subject line call-to-action. If they don't validate in a while, take an action appropriate for your specific context (notification on next login, second email, etc.).


I think that as the application designer, you have the responsibility to protect the users from themselves. Hence, you must provide some way for them to restore it.

The e-mail option has its downsides as you said but so are other alternative like security questions. Common approach is to include a link which automatically verifies the account w/o the user need to cut and paste.


Personally I think it should be a requirement that the user verifies the account before they are allowed to do ANYTHING.

I own an email address that some people would consider desirable. For whatever reason, people sign up for services using this email address that they absolutely know is not their own. I have to spend an hour every few months going through and deactivating accounts.

It's a real eye opener to see what websites do not require verification. Facebook, Twitter, Apple, Playstation, etc. I was able to log into someone else's Apple account (they used my email) using the forget password system and do the Find My Phone, and it worked, and showed me on a map where they were currently located. That is absolutely absurd. Apple wouldn't even let me close the account so it's just sitting there. I had similar problems where someone would sign up for Facebook and I would get dozens of notification emails a week. It also prevented me from using my own email address to sign up as myself, because it said it was in use. One time I even had someone who signed up for a non-mainstream social network to sell drugs.

  • This is why, when accounts are active without verification, that you should need to be logged in in order to complete that confirmation click. Without the service authenticating the user, you're just saying "Someone clicked the emailed link, but we can't tell who" - that's just verifying that it's a live address, not the correct address.
    – Beejamin
    Commented Aug 29, 2017 at 12:02
  • @stalephish I'm so curious what your email is, and I am utterly mindblown why someone would purposely signup using your address - especially to Apple etc and register their phone. Crazy
    – Worthy7
    Commented Sep 9, 2019 at 5:25
  • 1
    @Worthy7 The email address the name of an A-list celebrity. I imagine most people purposely using it fall into 2 categories: 1) hoping the real celebrity owns the email address and will see the account get created and use that to personally contact them, or 2) bragging rights that the celebrity's email address will show up on their public profiles of the accounts.
    – StalePhish
    Commented Sep 9, 2019 at 13:11

Yes, you must always verify email addresses with a test message containing a challenge code or link. Why? Don't only think about yourself! Keep in mind the inconvenience that you generate for many innocent non-users of your system, namely all the actual owners of email addresses that your users mistyped!

Example: I am [email protected], which seemed like a good idea at the time. However there are now at least a dozen other people on this planet, presumably having the same name as me, who regularly accidentally think that this is their email address (e.g. forgetting about some trailing digits in [email protected]), and give my address to service providers. And then I have to deal with unsubscribing myself again, which is often very difficult and time consuming.

I wish there were a legal requirement to verify email addresses with a test challenge message before storing them. It would avoid a lot of grief for the owners of addresses commonly mistyped by people with similar names.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.