Our website uses a system where the username is the user's email address. We have a function which permits the user to change his email.

What is the best way to go about this?

  • Send an email only to the new email address just to confirm the change.
  • Send an email to both the new and the old email addresses for confirmation.
  • Send an email to the new address, asking the user to click a button for activation.
  • I'm open to any different suggestions as well.

I'm concerned about functionality, security and usability. There could be some problems with activation; for example, activating an email address that has been created between the change request and the changed email activation would certainly cause some problems. I'm probably forgetting other corner cases...


The most common way is to:

  1. Ask the user to enter her password before changing e-mail (even if she is currently logged in): this will help to avoid stealing of the account if user has forgotten to logout or somebody simply got user's cookies or something like this.

  2. Send an activation link to the new address and don't switch e-mails until the new one will be activated: this will ensure that user has entered the correct e-mail address she has access to.

  • 3
    Instead of step 2, you can make the change but send a notification to the previous email address with link provide to undo/reset the action if required. This removes a barrier for the majority of use cases (genuine change of email, not malicious). – Fractional Jun 6 '14 at 13:33
  • 4
    @RedSirius but you will not be sure the new e-mail is valid in that case, and what if there is a typo in the e-mail address? – alexeypegov Jun 6 '14 at 14:08
  • 1
    You can still send a notification to the new address, just not require the activation step :) – Fractional Jun 6 '14 at 15:09
  • 5
    @RedSirius What if the user is changing the email address because their old one has been hijacked? – dmur Jun 17 '16 at 7:54
  • 2
    @PirateApp Could you please rephrase your thought process? I am a little bit confused. Why would the attacker not be able to login even if the new email address is owned by the attacker? You say: Ask for old password (to activate email change) > Enter new email > Send confirmation link to new email > Receiver clicks on the activation link in the new email > Now user has to log in again (implying that the old session was destroyed). How does this protect agains attacker if the attacker knows the old password and changes the email? It doesn't. – vaid Jul 25 '20 at 12:01

In my opinion these steps should be secure and user friendly enough:

  1. Ask for password confirmation in the form to prevent other people to change the email address when someone forgot to logout.
  2. Send an email to the old email address to let the user know that is has been changed and offer the possibility to prevent or revert the change.
  3. Send an email to the new email address to verify the email address.
  4. When the user verifies the new email address, change the old email address to the new one but keep the old one in case it needs to be reverted. To check if the old email address is actually the previous one you should save it somewhere.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.