Web Security / Sessions and logins
Lesson 19 of 27
Password reset flows
Reset links should be random, single-use and expire quickly. Never reveal whether an email address has an account.
Key points
- Long random tokens
- Expire in 15-60 minutes
- One use only
Quiz · +10 XP
What makes a password reset link safe?
Log in to save progress and earn XP.