I'm building a new web site. I'm now writing the code where a user can request an email to reset a lost password. As I'm writing it, it occurs to me that there could be several scenarios:

  1. The user simply forgot their password and needs a reset, so it doesn't matter if I let the old password be valid.
  2. A hacker got into the user's email account and has requested a password reset from my site, so it's best to leave the old password valid for a few days so the user can get back into the account and alert a mod.
  3. The user's password is compromised and needs it changed immediately, so letting the old password be valid risks letting unauthorized persons into the account.

What is the solution to this dilemma?

2 Answers 2


You should change the password immediately. There are several reasons for this:

  1. If the account has been compromised allowing the old password will mean that the account is still compromised and the attacker will be able to change it again.
  2. Every other system changes the password immediately, so this is what the user will be expecting.
  3. If you allow the old password the user might not think that the password has in fact been changed so may well initiate the "change password" procedure again.

All changes for a password should be confirmed via an e-mail sent to the registered address and as long as you don't allow a change of password and a change of contact e-mail address at the same time then the it should be difficult for an attacker to gain control over the account.

You would only allow the change when the user visits the page you link to in the e-mail or allow the change to be rejected via a link.

  • How much time should I require between a change of password and a change of contact e-mail address? A week? FYI, this is just a small social chat site that will never grow beyond a few hundred people or so; no financial or identity information is available.
    – Fredashay
    Commented Jul 22, 2013 at 22:48
  • @Fredashay - It doesn't have to be very long - it just has to be two separate actions so an attacker can change both at once. If they can change the e-mail and then get the password reset link sent to that address the owner has lost the account.
    – ChrisF
    Commented Jul 22, 2013 at 22:48

The email to reset the password shouldn't change the password until the recipient clicks on the link in the email. If the password is changed when the email is sent out, then you have effectively locked out the real user in the case that somebody else had requested that their password be reset.

Once the user clicks on the link in the email to reset the password, the new password should take effect immediately.

If you have a form for logged in users to change their password, that should take effect immediately. Users will probably use that in the case they wish to change their password for security reasons.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.