Our website uses a system where the username is the user's email address. We have a function which permits the user to change his email.

What is the best way to go about this?

  • Send an email only to the new email address just to confirm the change.
  • Send an email to both the new and the old email addresses for confirmation.
  • Send an email to the new address, asking the user to click a button for activation.
  • I'm open to any different suggestions as well.

I'm concerned about functionality, security and usability. There could be some problems with activation; for example, activating an email address that has been created between the change request and the changed email activation would certainly cause some problems. I'm probably forgetting other corner cases...


The most common way is to:

  1. Ask the user to enter her password before changing e-mail (even if she is currently logged in): this will help to avoid stealing of the account if user has forgotten to logout or somebody simply got user's cookies or something like this.

  2. Send an activation link to the new address and don't switch e-mails until the new one will be activated: this will ensure that user has entered the correct e-mail address she has access to.

| improve this answer | |
  • 3
    Instead of step 2, you can make the change but send a notification to the previous email address with link provide to undo/reset the action if required. This removes a barrier for the majority of use cases (genuine change of email, not malicious). – Fractional Jun 6 '14 at 13:33
  • 4
    @RedSirius but you will not be sure the new e-mail is valid in that case, and what if there is a typo in the e-mail address? – alexeypegov Jun 6 '14 at 14:08
  • 1
    You can still send a notification to the new address, just not require the activation step :) – Fractional Jun 6 '14 at 15:09
  • 1
    @alexeypegov's answer seems ticks the box for both security and validation. You need to confirm the account to prevent users setting up the wrong email address. A notification won't do this. I doubt that the user will even read it correctly. – John Reid Oct 30 '14 at 9:12
  • 5
    @RedSirius What if the user is changing the email address because their old one has been hijacked? – dmur Jun 17 '16 at 7:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.