Designing Secure Password Reset and Account Recovery

Account recovery is often a weaker path than login itself. A secure reset flow must prevent account enumeration, protect tokens, and limit automated abuse without locking out legitimate users unnecessarily.

Generate unpredictable, single-use reset tokens using a cryptographically secure source. Store a hash of the token when practical, associate it with the intended account, and enforce an expiry. After successful use, invalidate the token and consider invalidating existing sessions based on the risk and application requirements.

Return a generic response whether or not an email address exists. Rate-limit requests by multiple signals, while avoiding a design that lets an attacker permanently deny service to a victim. Do not send passwords in email; send a short-lived reset link over HTTPS instead.

Log security-relevant events without recording raw tokens or passwords. Test expired links, reused links, simultaneous requests, email changes, and attempts to reset another user's account. Recovery should be straightforward for the owner and unhelpful to someone who only knows an email address.