How much time should we give a newly registered user to click the confirmation link sent by email? I can't find any best practise on how long a confirmation link should be valid.
The expiration time should be the time it takes your system to send the e-mail, plus the time it takes a user to receive and read the e-mail, plus the time it takes a user to click the one-time confirmation link in the e-mail sent to the user, plus the time it takes your system to register the confirmation link. Plus any possible unforseen events at your server and interruptions at the user.
And how long is that? I'd say no more than a couple of hours. But be sure to have a re-send confirmation link e-mail available if something goes terrably wrong during this process.
Reference: Must upvoted answer to the question "How long should an e-mail address confirmation link last and why must it expire at all?" on our sister site Information Security.
I've seen confirmation mails that decay and die over 2 hours and I've personally clicked on confirmation mails 4 months after their date of delivery and found them to be valid.
Essentially - you should pick your decay algorithm (which determines when the validity is up) or formula based on the type of confirmation i.e. if its critical, casual or just a e-mail ownership check. Critical events call for a faster decay, while casual and email ownership checks can decay over a long duration or just not decay at all.
- If your confirmation is to prevent or detect hacking or unauthorized entries into an account
- If your confirmation is an OTP (One Time Password) or authentication codes
Casual examples -
- Account registration & e-mail activation
- validating e-mail for posting rights etc.
In most cases, 12 ~ 24 hrs is popular because of time zones. But you'll have to do your user research to determine the best number for your application. I would consult a security engineer.
How much time should we give a newly registered user to click the confirmation link sent by email?
You won't find one answer to this question as every organization and registration process has its own context and demands. Let me rephrase the question and see what comes up.
- Why is it important to make a hyperlink invalid? If your answer is system-concerns including security, then it is systems' need and must not take precedence over human needs.
- How much value (customer/financial/primary/secondary objectives) would be compromised once a link becomes invalid vs how much would you gain as a result? Cost-Benefit Analysis.
- How often would your customer base check their emails? If I am dealing with senior audience, for them email checking would be less frequent than tribes who live online.
I don't understand your context of use but my general expression is that the link should remain valid as long as possible, keeping it active for several days at least. You can learn from GoDaddy and Udemy's promotional emails carrying discount coupons. Their emails stay valid for 3+ days because they know even when user has direct benefit in using this coupon, they will still take considerable time to find the empty time-slot and be able to make use of it.
The duration of validity completely depends on the kind of application for which the confirmation link is used for. If it's a security application or some application where being human or a bot is a critical factor then you can keep the duration as low as 2 hours or maybe if the application is fun and not really very security critical then it can be 8 hours. But according to me, it shouldn't be anywhere more than 24 hours.
Just make sure the link is received by the user within 24 hours of signing up. Sometimes, I have received it after 48 hours.
I hear it as an in-flight confirmation code, the code is an alphanumeric sequence typically six characters long that identifies a specific reservation & it takes 4 hours to confirm if the code does not come then we have to call an airline.
We should give at least two days to newly registered users to click the confirmation link.