Do I need password reset and account recovery flows?

Yes—most products should have both, unless you’re intentionally building a very constrained system.

You typically need:

• Password reset: if users can log in with passwords, they will forget them.
• Account recovery: if users lose access to their email, phone, device, or second factor, they need a way back in.

Why both matter

• Reset fixes the common case: user forgot password.
• Recovery handles the harder case: user can’t complete normal reset/login because they lost access to their recovery channel(s).

When you might not need them

You may be able to avoid traditional password reset/recovery if:

• You use passwordless authentication only, with reliable recovery built into the identity provider.
• You rely entirely on SSO/enterprise IdP and do not manage local credentials.
• Your app is internal and account access is handled by admins.

Best practice

If you do need them, design recovery carefully:

• Use verified channels only
• Add rate limiting and abuse protections
• Avoid revealing whether an account exists
• Prefer step-up verification for recovery
• Log and notify users of recovery events

Rule of thumb

If a user can ever get locked out, you need a recovery path. If users use passwords, you almost certainly need password reset.

If you want, I can help you decide for your specific app and suggest a minimal secure design.