password reset and session security
password reset protects email accounts by using a reset flow instead of support manually changing passwords. reset can also affect active sessions.
quick answer
use forgot password when the user cannot sign in, and expect old sessions to be treated carefully afterward.
use this for
- forgot password support
- security explanations
- debugging sign-in after reset
steps
- open the login screen.
- choose forgot password.
- enter the account email.
- use the reset link or code sent to the inbox.
- set a new password.
- sign in again on trusted devices.
details to know
- reset flows are rate limited.
- password reset emails should go only to the account email.
- old sessions may be revoked so a reset actually protects the account.
limits and edge cases
- support should not ask for the current password.
- users should not reuse weak passwords.
- if the inbox is compromised, resetting the app password is not enough.
ready to use the product instead of reading about it?
open app