What is a self-service password reset?

A self-service password reset enables a user to reset their password without help from IT staff. Often, this involves sending a password reset link to the user’s account.

Why do I keep getting password resets?

If you aren’t initiating a password reset, it may indicate an attempt by someone else to gain access to your account. Anyone can initiate a password reset, but only someone with access to the email account where the reset email is sent can actually change the password.

How long do password resets last?

The length of time that a password reset lasts depends on the service. Most password resets are good for less than half an hour to limit the potential for abuse.

What is best practice for password reset?

Password resets should be designed to provide users with a secure but user-friendly means of resetting their passwords. However, a better approach is to use passwordless authentication that makes password resets unnecessary.

What are the basic rules for password management?

Passwords should be long, unique, and randomly generated. For password-based authentication systems, a password manager is a good way to generate and store secure passwords.

What is password reset poisoning?

Password reset poisoning attacks intercept password reset requests and modify them so that the links contained within a legitimate password reset email point to an attacker-controlled site. This allows an attacker to steal the unique password reset token and use it to change the user’s password.