In a system I'm developing, we send out a password(?) to a user. They can request a new password - sent via email, but they can never set it themselves.

Is there a good word for this type of thing? Passcode maybe?

  • whats the context
    – Mervin
    May 17 '15 at 3:54
  • They enter in the code to allow them to reserve tools from a shop.
    – kylex
    May 17 '15 at 4:00
  • Don't send passwords via email. That's wrong. Period. Emails are not a secure communication channel as it's not encrypted end-to-end. If you can't send the initial password via a third-party channel (e.g. in person at registration booth or via SMS assuming that you trust their phone service provider and all the intermediaries), you're better off letting users set it -- and possibly providing a service that creates new, random passwords on the client-side that users can decide to write down in their method of choice (hopefully, though probably not, a password manager) and use in the future. May 18 '15 at 23:39

Token is a good term for it. This is what OWASP (the open web application security project) refers to it as.

You may want to look at the owasp guidelines for forgotten password - https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet

It is very deliberately not called password as you should never send a password via email. Tokens are usually used to validate a side channel, i.e. that you have access to the email account.

Passwords should only ever be known by the user. A system should never know it, apart from the very short, transient process of taking it from a user and transforming it into a digest (either to store on a change of password, or to compare for authentication).

After reading what you want to use if for - you may want to just call it a code. Or ask your users what makes sense to them. Token may be a bit confusing to an end user. Shopping code / item code / offer code / code / ticket may be a bit more friendly?


I think the term you are looking for is "Verification code"

Here are some examples

enter image description here

enter image description here


There are several terms used for this:

  • Token (or verification token)
  • One-time password (or OTP)
  • Temporary password
  • Verification code
  • Validation code

They are loosely interchangeable.

In your case, if the system sets the password and it's persistent (Ie the user doesn't change it except to request another system-assigned password) then it's probably just a password or an assigned password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.