Nobody visits a product hoping to reset a password. People arrive at the “Forgot password?” link already annoyed, usually in a hurry and often on a phone. How your product handles that moment decides whether they return to what they were doing or give up entirely.

Password reset is one of the most overlooked flows in product design, yet it affects a large share of users and a large share of support tickets. This guide explains how a good reset flow works, the design decisions behind it, and the mistakes that quietly cost products users.

Why Password Reset Design Matters

• It rescues lost users. Someone who cannot log in is one failed attempt away from leaving for good.
• It reduces support costs. Password-related requests are among the most common help desk tickets.
• It is a security boundary. A weak reset flow can become the easiest way to take over an account.
• It shapes trust. Clear, calm recovery makes a product feel reliable, while a confusing one signals carelessness.

The design challenge is unusual: the flow must be easy for the real owner and hard for everyone else.

The Anatomy of a Password Reset Flow

A typical email-based flow has five steps:

1. Entry point. A visible “Forgot password?” link on the login screen.
2. Identification. The user enters their email, username or phone number.
3. Confirmation. The interface confirms that instructions were sent, without revealing too much.
4. Verification. The user clicks a link or enters a code from their email or phone.
5. New password and sign-in. The user sets a new password, receives confirmation and is signed in or returned to login.

Mapping each step in a clear user flow helps teams spot the points where people get stuck, such as a delayed email or an expired link.

Reset Methods Compared

Email link

The most common approach. Users click a unique, time-limited link. It is familiar and easy to implement, but depends on email delivery and on the user having access to their inbox.

One-time code (email or SMS)

The user types a short code. Codes work well on mobile and avoid link-clicking problems, but typing them adds friction and SMS is less secure than email or app-based methods.

Authenticator or device prompt

Verification through an app or trusted device. Strong and fast for users who have set it up.

Security questions

Generally discouraged. Answers are often guessable or discoverable, and users forget them.

Support-assisted recovery

A fallback for users locked out of every other method. It needs strong identity checks and a clear process.

Most products offer one primary method and one or two fallbacks.

Best Practices for Password Reset Flow Design

1. Make the entry point obvious

Place “Forgot password?” next to the password field, in a readable size and contrast. Users who are already frustrated should not have to hunt for it. After a failed login attempt, consider surfacing it more prominently.

2. Ask for the minimum on the first screen

One field, one button. If your product uses email as the identifier, ask only for email. Pre-fill it if the user already typed it on the login screen, which saves effort at a stressful moment.

3. Use neutral confirmation messages

To avoid revealing which emails have accounts, show a message such as “If an account exists for this email, we have sent reset instructions.” Pair it with practical help: check your spam folder, how long to wait and how to try again or use a different address. This balances security with clarity.

4. Write clear, scannable emails

The reset email is part of the interface. Good ones:

• Use a clear subject line, such as “Reset your [Product] password”
• Put one prominent button above the fold
• Explain how long the link is valid
• Include a plain-text link fallback
• State what to do if the user did not request the reset
• Avoid marketing content and distracting design

Strong UX writing matters here, because people scan these emails in seconds.

5. Set sensible link lifetimes

Links should expire, since long-lived links are a security risk, but not so quickly that normal delays cause failure. Many products use between 15 minutes and a few hours, depending on risk. Make links single-use, and invalidate older links when a new one is requested.

6. Handle expired and used links kindly

When a link no longer works, explain why and offer a one-click way to request a new one. A dead-end error page forces users to start over from scratch.

7. Make the new-password screen easy

Show requirements upfront, include a visibility toggle, allow pasting and support password managers with correct field attributes. Where possible, favor length over arbitrary complexity rules, and check passwords against known breached lists. Give inline feedback as users type, such as a strength hint, not an error after submission.

8. Confirm success and guide the next step

After a successful reset, say so clearly and take the user where they were headed, either signed in automatically (where risk allows) or to login with the email pre-filled. Don’t leave them on a blank confirmation page.

9. Notify the account owner

Send a short email after a password change: “Your password was changed. If this was not you, secure your account here.” It confirms success and helps detect takeovers quickly.

10. Protect against abuse

Apply rate limiting to reset requests, use unpredictable tokens, avoid exposing tokens in URLs that get logged where possible, and consider ending active sessions on other devices after a reset. Security design should be reviewed rigorously, and services such as security audits and compliance reviews help teams confirm the flow is robust behind the scenes.

11. Consider multi-factor accounts

If an account uses MFA, the reset flow should not bypass it carelessly. Offer backup codes or other recovery options, and make the process clear without weakening protection.

Accessibility and Inclusion

Recovery flows must work for everyone, including people using assistive technology or experiencing cognitive load.

• Use proper labels, autocomplete attributes and logical focus order
• Announce confirmation and error messages to screen readers
• Maintain strong contrast and visible focus states
• Don’t rely on color alone for validation feedback
• Avoid requiring users to memorize or transcribe complex information without alternatives, in line with WCAG 2.2 accessible authentication guidance
• Offer alternatives to puzzle-style CAPTCHAs

For broader guidance, read our article on inclusivity and accessibility in experience design.

Design for Mobile

Many resets happen on phones, where users must switch between the app and their email client.

• Preserve state so users return to the right screen after opening the email
• Use deep links that open the app when installed
• Show the correct keyboard type for each field
• Make buttons large enough to tap easily
• Support auto-filled codes from messages where available

Examples of Good Password Reset Design

A calm confirmation screen. After the user submits their email, the page says “Check your inbox,” shows the email address they used, explains the expected wait and offers “Resend email” and “Use a different email” options.

A helpful expired-link page. Instead of “Invalid token,” the message reads “This link has expired. Request a new one,” with a button that does exactly that.

A smooth new-password screen. The page shows requirements as a checklist that updates live, includes a show/hide toggle and ends with “Password updated. You’re signed in.”

A reassuring security email. A follow-up message notes the time and device of the change and gives a clear link to secure the account if something looks wrong.

Common Password Reset Mistakes

• Hiding or omitting the “Forgot password?” link
• Asking for too much information upfront
• Revealing whether an email is registered through different messages
• Vague confirmations with no mention of spam folders or timing
• Links that expire too quickly or never expire
• Dead-end error pages for expired links
• Sending the old password in plain text, or generating weak temporary passwords
• Overly strict or unexplained password rules
• Blocking paste and breaking password managers
• Forgetting to notify the user after a change
• No rate limiting against abuse
• Ignoring mobile behavior and accessibility
• Manipulative tactics, such as pushing marketing consent during recovery, which falls into dark patterns territory

Measure and Improve

Track the share of login attempts that lead to reset requests, completion rate at each step, time to complete, email delivery and open rates, link expiry failures and repeat requests. Observe real sessions to see where people struggle, and compare variants of copy and layout using an A/B test. A high reset rate may also signal that the underlying login experience needs work, for example through passkeys or better password manager support.

A Quick Checklist

• Is “Forgot password?” easy to find?
• Does the first screen ask for only one thing?
• Are confirmation messages neutral but helpful?
• Is the email clear, scannable and safe?
• Are links time-limited, single-use and gracefully handled when expired?
• Is the new-password screen easy, with live guidance?
• Do we confirm success and notify the account owner?
• Is the flow accessible, mobile-friendly and protected against abuse?

Bringing It All Together

A great password reset flow is quiet. Users find the link, enter their email, receive a clear message, set a new password and carry on. Behind that simplicity sit careful decisions about security, copy, timing, accessibility and recovery from failure.

Walk through your own reset flow this week as a user would: on a phone, with a slow email, with an expired link and with a screen reader. Each friction point you find is a user you can keep.

If you want help designing authentication and recovery flows that are secure and easy to use, work with a trusted UI UX design company in Bangalore that can help you design, test and refine journeys users complete with confidence.