J
jeremy
7 minutes
Password Reset by a Single-Use Token Sent to the Email on File
A reset flow proves control of the account's email address: you generate a long random token, store only its hash with a short expiry, email the raw token in a link, and on use check the hash, check the time, delete the record and then change the password. Storing the raw token would mean a database leak resets every account; skipping expiry or single use leaves old links live in inboxes forever. The page that starts the flow says the same thing whether or not the address exists, so it cannot be used to test emails.