How much time should we give a newly registered user to click the confirmation link sent by email? I can't find any best practise on how long a confirmation link should be valid.
Thanks for sharing your experience.
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It only takes a minute to sign up.Sign up to join this community
The expiration time should be the time it takes your system to send the e-mail, plus the time it takes a user to receive and read the e-mail, plus the time it takes a user to click the one-time confirmation link in the e-mail sent to the user, plus the time it takes your system to register the confirmation link. Plus any possible unforseen events at your server and interruptions at the user.
And how long is that? I'd say no more than a couple of hours. But be sure to have a re-send confirmation link e-mail available if something goes terrably wrong during this process.
Reference: Must upvoted answer to the question "How long should an e-mail address confirmation link last and why must it expire at all?" on our sister site Information Security.
I've seen confirmation mails that decay and die over 2 hours and I've personally clicked on confirmation mails 4 months after their date of delivery and found them to be valid.
Essentially - you should pick your decay algorithm (which determines when the validity is up) or formula based on the type of confirmation i.e. if its critical, casual or just a e-mail ownership check. Critical events call for a faster decay, while casual and email ownership checks can decay over a long duration or just not decay at all.
Casual examples -
In most cases, 12 ~ 24 hrs is popular because of time zones. But you'll have to do your user research to determine the best number for your application. I would consult a security engineer.
How much time should we give a newly registered user to click the confirmation link sent by email?
You won't find one answer to this question as every organization and registration process has its own context and demands. Let me rephrase the question and see what comes up.
I don't understand your context of use but my general expression is that the link should remain valid as long as possible, keeping it active for several days at least. You can learn from GoDaddy and Udemy's promotional emails carrying discount coupons. Their emails stay valid for 3+ days because they know even when user has direct benefit in using this coupon, they will still take considerable time to find the empty time-slot and be able to make use of it.
The duration of validity completely depends on the kind of application for which the confirmation link is used for. If it's a security application or some application where being human or a bot is a critical factor then you can keep the duration as low as 2 hours or maybe if the application is fun and not really very security critical then it can be 8 hours. But according to me, it shouldn't be anywhere more than 24 hours.
Just make sure the link is received by the user within 24 hours of signing up. Sometimes, I have received it after 48 hours.