Don’t underestimate the value of a secure, seamless ‘forgot password’ flow

Rishi Raman

Learn about “forgot password” flows, how they work, and the best practices to keep in mind.

Just about every software application today relies on individual user accounts to provide people with a personalized and private experience. However, as “software eats the world,” the average user is managing an increasing number of accounts. Practically every online store, social media platform, SaaS product, newsletter, game, and group requires users to create an online account with a username and password. The average American adult has a total of 130 online accounts — and they all need to be kept secure, which exacerbates an already all-too-common problem: lost and forgotten passwords.

That’s why most apps offer password reset flows. This essential workflow allows users to reclaim their accounts while maintaining their security and privacy. Keep reading to learn about “forgot password” flows, how they work, and the best practices to keep in mind.

‌

What is a ‘forgot password’ flow?

If you’ve ever had to reset a password, you’ve gone through a “forgot password” flow. Users go through this self-service process to reset their passwords and reclaim their accounts. Any website, app, or other account that relies on passwords for security should have some kind of reset flow.

‌Why? Because users are prone to forgetting their passwords. It’s also common for people to forget their accounts entirely or change devices and lose their saved passwords. Without some way for users to quickly and easily reset passwords and reclaim accounts, you may lose users, have to support multiple accounts for the same user, and/or deal with an overwhelming number of “forgot password” support requests.

‌

How ‘forgot password’ flows work

Password resets can be manual or automatic. Manual resets rely on the user reaching out to support by email or phone. The support team member asks them some kind of security or verification questions and resets their password accordingly. However, manual flows mean that a significant percentage of your support tickets will be password resets, taking up your staff’s valuable time. Additionally, manual verification is often less secure than an automated process, and can be especially frustrating for a user that needs access quickly.

‌The alternative is to implement a self-service password reset (SSPR) process. These automated workflows allow users to reset their passwords or reclaim their accounts without human intervention. They’re used by most websites, apps, and other password-protected systems to streamline the security process. Your support staff won’t need to spend time answering password reset claims and can focus on more important work.

Each type of self-service flow works a little differently. For example:

Temporary passwords: This process will send the user a temporary password that they can use to access the system. The user then resets their password themselves once they’re logged in.
‌Email verification: The system emails the user a link at their primary email address, and the link takes them to a dedicated password reset page.
‌SMS verification: The system sends the user a text to confirm they want to reset their password, with instructions to follow the reset link.
‌Passwordless logins: Passwordless flows send a one-time link to the user’s email or phone, allowing them to log in without resetting their password at all. This can be great for a user that just wants to log in from a different device one time, or is pressed for time and wants to reset their password later on
‌Two-factor authentication (2FA) reset: Two methods are used instead of one to confirm the reset. The user confirms their identity one way and then resets their password with another method. The system may have them check their email or phone for the reset link, and then on the reset page, it may ask for a code that was sent to their phone or a sign-in authentication app.

‌

Why implementing SSPR workflows can be challenging

While password reset systems are essential, they can be a complex feature to implement on your own. Rolling your own password reset process means dealing with:

The constant evolution of best practices. Best practices regarding SSPR workflows are constantly evolving - from manual reset to security questions to email reset to SMS workflows to passwordless logins. You should keep up with these changes to make sure your password reset process stays secure and up-to-date.
‌Security maintenance. Password resets need to be a secure workflow end-to-end, or your users’ accounts are at risk of being hacked. If you write your own, designing a secure process is your responsibility.
‌Design and integration. Your reset process might be technically sound, but it should also be frictionless and well-designed, as an easy sign in experience is critical to retention.
Complexity. Adding more authentication features and options can provide an excellent user experience when everything works right, but it also creates the potential for more “edge cases” where problems occur.

‌‌‌

Get started with password resets today

If your team has more pressing features to focus on than creating a password recovery flow, Clerk can eliminate the guesswork (and real work) of user management and authentication. Clerk makes it easy to add complete user management to your app in minutes today, while allowing you to easily make changes and add new features in the future.‌