How to send password reset emails

To send password reset emails, you typically do this flow:

1. User requests a reset

   • They enter their email address on a “Forgot password?” page.

2. Generate a secure reset token

   • Create a long, random, single-use token.
   • Store a hashed version of it in your database, along with:
     • user ID
     • expiration time
     • whether it’s been used

3. Send an email with a reset link

   • Email the user a link like: https://yourapp.com/reset-password?token=...
   • The link should point to a page where they can set a new password.

4. Validate the token

   • When the user opens the link, verify:
     • token exists
     • token matches what you stored
     • token is not expired
     • token hasn’t already been used

5. Let them set a new password

   • Hash the new password securely.
   • Mark the token as used or delete it.

6. Send a confirmation email

   • Notify the user that their password was changed.

Important security practices

• Never send the password itself by email.
• Always use HTTPS for reset links.
• Make tokens expire quickly (commonly 15–60 minutes).
• Use rate limiting to prevent abuse.
• Avoid revealing whether an email exists:
  • respond with something like: “If an account exists, we sent a reset email.”

Example email text

Subject: Reset your password

Body:

We received a request to reset your password.
Click the link below to choose a new one:
https://yourapp.com/reset-password?token=abc123

If you didn’t request this, you can ignore this email.

Implementation options

You can send emails using:

• SMTP with providers like Gmail, Outlook, or your own server
• Transactional email services like:
  • SendGrid
  • Mailgun
  • Amazon SES
  • Postmark
  • Resend

If you want, I can show you:

• a Node.js example
• a Python/Django example
• a PHP/Laravel example
• or the database schema for reset tokens