User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It only takes a minute to sign up.
Sign up to join this community
When a user submits a reset password form, which UX is preferred?
A temporary password is created for them to use. It's emailed to them. They log in and then a permanent change password form is shown.
A link is emailed to the user that takes them directly to a change password form. The link has a unique id in the URL (which also expires).
Note: in neither situation is the actual password changed until the user completes the steps in the password reset email.
It's better to send the reset link for 3 reasons:
Usability Implications
A link is much more accessible. I can get to a link via click, tap, or with the keyboard easily; and in a confined device like a smart phone the process of opening the site in question is much smoother and easy. If I have to select, copy and paste a password from an email I need to be a little more dextrous, especially on fiddly little devices
Password reset links look more secure. Compare a little string of password data exposed as text in an email compared to a long hash link which isn't even an actual password and think of the mental effect on the user. Regardless of the actual security implications of either technique, any intelligent user is going to think that they are in more secure hands with a reset link
This blog post talks about a problem with both techniques, that the user may not have the same access to the email address they used for your account, causing a chain reaction of password related pain as they try to access that account, reset it's password ... secondary verification measures like secret questions or two step verification should be available too.
Password reset and send also has another implication as detailed in this blog post - a system that changes a password simply by providing an email address gives anyone the chance to lock someone out of an account without knowing a password. Say this is combined with an inaccessible old email address (or use of a username rather than email address in the form, meaning they might not even remember which email address they have used), the user is then unable to go and retrieve the password from their old email address. A link doesn't have this problem as the password is only reset when the link is clicked. Similar to this is the case where a user clicks to reset but then actually remembers. If the link is not used they can still get in without going to their email address.
Security Implications
A link is also a forced expire. It will only work for a preset length of time (say 15 mins or some such). Although you can force a user to enter a new password after using a temporary one, this stack exchange question, backed up by this general principle of human behaviour suggest that there's a pretty high chance the user will just use the temporary password, especially if you made it short / memorable enough. Bear in mind that they may well do this thinking 'it's OK, it's saved in my emails'. There are ways round this, like not letting them re-use that password, or making it fail your general rules etc. but all of those ideas will make things more difficult for them.
Email addresses are often now linked to phones and other mobile devices. A common feature with these devices are 'push notifications' where a message pops up on the screen. Crucially, this even happens and is visible, often with a summary, on the lock screen of the device, meaning you could actually leave someones device sitting there with the email address and the password in plain text on screen for anyone devious to see. A link cannot be clicked from a lock screen as it would require the device to unlock and load a browser.
Conclusion
Absolutely use a link.
This applies equally to email and sms text messages. Even if the password is temporary it can lower the credibility of your brand. Building a relationship of trust is one of the most important things we do and emailing passwords always feels wrong.
When sending a reset link it is also important to let the user know that the link itself will expire after a certain period of time (30 minutes - 1 hour). This is okay because most people requesting a password reset are doing so because they are trying to log in right now and having clickable links in email that reset passwords indefinitely is just as bad as sending out temporary passwords.
Finally, make sure the system that sends out the reset email is very reliable and fast. Users don't want to wait around too long for an email telling them how to proceed and may even request multiple resets if the system doesn't perform fast enough. The issue is compounded when the first reset email link arrives after the reset button is pressed a second or third time resulting in a link that no longer works even though it appears to the user it should. Be sure to let the user know when to expect an email as soon as they click the password reset button in order to properly set expectations.
Sending a link is a way more better because:
1- click link --> write new password
.. VS ..
2- copy password --> open browser --> open site --> paste password to login -> click on change password --> write new password
Some users will not change password after signing-in;
If you're designing for both desktop and mobile (ha! Who isn't now?) then it's a reset link is better than a temporary password. Why?
I find what happens when you send a temporary password, the user never goes back to change it and it's usually too difficult to remember. So what ends up happening is that the "forget password" link is pretty much used every time the user logs in. The goal really is to get them to reset their password to something that they will remember so best to be direct about it.
It's also more common (in my experience) for a password to be reset so a user may miss the temporary password in the email and cause more confusion.
Although I agree that a link is better than a temporary password in a plain text mail, I'd like to add that, as a user, I'm kind of afraid of those links, specially when I'm trying to recover my password by my own, by searching old e-mails of the website in my inbox. The URL is usually long, with many codes and I'm not sure if the web site will behave well if I use a URL that is not the last one generated, or not new enough, or that has already been used. It usually works fine; it's just a hesitation (this happens only to me?). Maybe this could turn into a detailed explanation somewhere in the help section of your website.
When the user forgets his password (I do too) I follow this procedure:
the form is called reset password form, not email me a temporary password form.
there's your answer right there
