Password Reset Email Templates (Best Practices & Examples)
Password reset emails are the most time-sensitive transactional emails you send. A user who clicks "Forgot Password" is locked out of your product and wants back in immediately. Every second of delay, every confusing instruction, and every email that lands in spam is a user who might never come back.
Yet password reset emails are also a prime target for phishing attacks, which means they need to balance speed and simplicity with security. The best password reset emails arrive instantly, make the reset action obvious, and include clear security guidance - all without looking like the phishing emails they need to differ from.
For a deeper look at how password reset emails fit into your overall transactional email strategy, see our guide on how to send password reset emails for SaaS.
Understanding the Password Reset Flow
Before diving into templates, it's important to understand the full password reset flow. The emails below cover different stages:
- Reset request - user clicks "Forgot Password" and receives a link or code
- Reset confirmation - user successfully changes their password and receives confirmation
- Account not found - someone requests a reset for a non-existent email
- Forced reset - you proactively reset passwords due to a security concern
- Admin reset - a team admin resets a user's password
Each stage has different content needs, tone, and urgency. The reset request email needs to be fast and simple. The reset confirmation needs to alert the user if they didn't initiate the change. The forced reset needs to explain what happened without causing panic.
Password Reset Email Templates
Standard Password Reset
This is the core template that handles 90% of your password reset volume. It needs to be fast, clear, and secure. Every element serves a purpose - there's no room for marketing or extraneous content.
Subject: Reset your [Product] password
Hi Sarah,
We received a request to reset the password for your [Product] account associated with sarah@company.com.
[Reset My Password] ← button
This link expires in 1 hour. After that, you'll need to request a new password reset.
Can't click the button? Copy this link: https://app.example.com/reset-password?token=abc123def456
Didn't request this? You can safely ignore this email. Your password won't be changed unless you click the link above. If you're concerned about your account security, you can review recent activity at https://app.example.com/settings/security
The [Product] Team
Why this works: The email is three elements: context (what happened), action (reset button), and safety net (didn't request this). No marketing, no upsells, no distractions. The one-hour expiration is short enough to be secure but long enough for most users to complete the reset. The plain-text link fallback handles email clients that block buttons.
Password Reset with Security Context
For security-conscious products (financial services, healthcare, enterprise SaaS), including request details like location and device helps users verify that the reset request is legitimate.
Subject: Password reset request for your [Product] account
Hi Alex,
Someone requested a password reset for your account. Here are the details:
Request details:
- Account: alex@company.com
- Requested at: March 6, 2026 at 3:42 PM EST
- From: Chrome browser, Portland, OR, United States
If this was you, click the button below to set a new password:
[Reset Password] ← button
This link expires in 1 hour and can only be used once.
If this wasn't you: Someone may have your email address but doesn't have access to your account. No action is needed - your password remains unchanged. However, if you receive multiple unexpected reset requests, contact our security team at security@example.com.
Security tips:
- Never share your password or this reset link with anyone
- [Product] will never ask for your password via email
- Use a strong, unique password (at least 12 characters)
- Consider enabling two-factor authentication
The [Product] Security Team
Why this works: The location and browser details help users verify legitimacy. If the request came from their usual location and browser, they proceed with confidence. If it came from an unfamiliar location, they know to be cautious. The security tips section is educational without being preachy.
Password Reset Confirmation
This email fires after a successful password change. It's both a confirmation and a security alert - if the user didn't change their password, this email is the first warning that their account may be compromised.
Subject: Your [Product] password has been changed
Hi Sarah,
Your password was successfully changed.
Details:
- Account: sarah@company.com
- Changed at: March 6, 2026 at 3:55 PM EST
- From: Chrome browser, Portland, OR, United States
You can now sign in with your new password.
[Sign In] ← button
Didn't change your password? Your account may have been compromised. Take these steps immediately:
- Reset your password again
- Review your account activity
- Enable two-factor authentication
- Contact our security team: security@example.com
The [Product] Security Team
Why this works: The confirmation gives the user peace of mind that the change went through. The "didn't change your password" section is critical - it's the early warning system for account compromise. The numbered steps give clear, actionable guidance rather than vague "contact support" advice.
Password Reset for Mobile Apps
Mobile apps often use verification codes instead of links because switching between email and app is smoother with a code than a link that opens a browser.
Subject: Your password reset code: 847291
Hi Jamie,
Use this code to reset your [Product] password:
847291
Enter this code in the app to set a new password.
This code:
- Expires in 15 minutes
- Can only be used once
Or reset via web browser: If you prefer, click this link to reset your password in your browser:
[Reset Password in Browser] ← button
Didn't request this? Ignore this email - your password won't be changed.
The [Product] Team
Why this works: The code is prominently displayed and easy to read. Including both a code and a browser link accommodates users who might be on desktop. The 15-minute expiration is appropriate for codes - shorter than links because codes are easier to guess or intercept.
Password Reset - Account Not Found
This is a security-sensitive template. When someone requests a password reset for a non-existent email, you should still send an email to that address. This prevents attackers from using the reset flow to discover which email addresses have accounts (email enumeration attack).
Subject: Password reset attempt - no account found
Hi,
We received a password reset request for this email address, but we don't have an account associated with it.
Possible reasons:
- You may have signed up with a different email address
- Your account may have been deleted
- Someone may have entered your email by mistake
If you have a [Product] account: Try requesting a password reset with other email addresses you may have used to sign up.
If you don't have an account: You can create one at https://app.example.com/signup
Why are we sending this? We send this notification for security purposes - to let you know someone attempted to use your email address. No account information was disclosed and no action is needed.
The [Product] Team
Why this works: The user still receives a response (so the behavior is identical to a successful reset request from an attacker's perspective). The helpful suggestions (try other email addresses) assist legitimate users who may have used a different email. The security explanation builds trust.
Forced Password Reset (Security Breach)
When you detect a potential breach or credential exposure, you need to proactively reset passwords. This email needs to balance urgency (act now) with calm (your data is safe).
Subject: [Action Required] Your [Product] password has been reset for security
Hi Sarah,
We're writing to let you know that we've reset your [Product] password as a precautionary security measure.
What happened: During a routine security review, we identified that your password may have been exposed in a third-party data breach (not a breach of [Product] systems). To protect your account, we've proactively reset your password.
What to do now:
[Set a New Password] ← button
When setting your new password:
- Use a password you haven't used on any other website
- Make it at least 12 characters with a mix of letters, numbers, and symbols
- Consider using a password manager like 1Password or Bitwarden
- Enable two-factor authentication for added security
Your data is safe:
- No unauthorized access to your [Product] account was detected
- This reset is a precautionary measure based on third-party breach data
- Your [Product] data, settings, and content are unaffected
This link expires in 24 hours. If it expires, request a new reset from the login page.
If you have questions, contact our security team at security@example.com
The [Product] Security Team
Why this works: It clearly distinguishes between a third-party breach and a breach of your systems - critical for maintaining trust. The password guidelines are practical and specific. The "your data is safe" section addresses the biggest fear immediately. The longer expiration (24 hours vs. 1 hour) is appropriate because the user didn't initiate this - they may not see it immediately.
Admin-Initiated Password Reset
In B2B and enterprise products, admins sometimes need to reset user passwords. This email needs to explain who initiated the reset and why the user needs to act.
Subject: Your [Product] password has been reset by your admin
Hi Tom,
Your team administrator has reset your [Product] password. You'll need to set a new one to continue using your account.
[Set New Password] ← button
Details:
- Account: tom@company.com
- Reset by: admin@company.com
- Date: March 6, 2026 at 10:15 AM EST
This link expires in 24 hours.
If you have questions about why your password was reset, please contact your team administrator.
The [Product] Team
Why this works: It clearly identifies who initiated the reset, which prevents confusion and unnecessary security concerns. Directing questions to the admin (rather than your support team) is appropriate since the admin made the decision.
Temporary Password Email
Some legacy systems still use temporary passwords. While not ideal (links are better), if you must send a temporary password, here's how to do it securely.
Subject: Your temporary [Product] password
Hi Sarah,
Your password has been reset. Here's your temporary password:
TmpPwd#8x2K9m
[Sign In Now] ← button
Important:
- This temporary password expires in 4 hours
- You'll be required to set a new password immediately after signing in
- Don't share this password with anyone
- Delete this email after you've set your new password
If you didn't request a password reset, contact security@example.com immediately.
The [Product] Security Team
Why this works: The temporary password is clearly marked as temporary. The requirement to change it immediately is stated. The "delete this email" instruction is good security hygiene.
Password Reset Subject Lines
Standard resets:
- "Reset your [Product] password"
- "Password reset request for your account"
- "Your password reset link - expires in 1 hour"
- "Reset your password for [Product]"
- "[Product]: Password reset link inside"
Code-based resets:
- "Your password reset code: 847291"
- "[Product] password reset code: 847291"
- "847291 - your [Product] password reset code"
Security-related:
- "[Action Required] Your password has been reset for security"
- "Your [Product] password was changed"
- "Important: Password reset required for your account"
- "Security notice: Password change detected"
Confirmation:
- "Your [Product] password has been changed"
- "Password changed successfully - [Product]"
Keep subject lines clear and functional. Avoid creative copy that might look like phishing. "Reset your [Product] password" is better than "Oops! Looks like you forgot something." Creative subject lines on security emails erode trust and look suspicious.
Best Practices for Password Reset Emails
Deliver within seconds
Password reset emails should arrive within 3-5 seconds. Users are waiting on a "check your email" screen and will become frustrated after 30 seconds. If your reset emails take minutes to arrive, fix your email infrastructure before anything else.
The delivery speed of your reset email is a direct function of your email infrastructure. Use a dedicated transactional email pipeline, separate from marketing sends. Ensure your email authentication (SPF, DKIM, DMARC) is properly configured so emails don't get delayed by spam filters.
Use short expiration times
Reset links should expire in 1-4 hours. Codes should expire in 10-15 minutes. Short expiration windows limit the attack surface if the email is intercepted. Always tell the user how long they have and how to get a new link if it expires.
| Reset Type | Recommended Expiration | Reason |
|---|---|---|
| Link (user-initiated) | 1 hour | Balance between security and usability |
| Code (mobile) | 10-15 minutes | Codes are easier to intercept |
| Forced reset link | 24 hours | User didn't initiate, may not see immediately |
| Admin reset link | 24 hours | Same as forced reset |
| Temporary password | 4 hours | Should be changed on first login |
Make single-use tokens
Every reset link or code should work exactly once. After the user resets their password, the link should be invalidated immediately. This prevents the link from being used again if the email is later accessed by someone else.
Also invalidate all outstanding reset tokens when a new one is issued. If a user requests a reset three times, only the most recent link should work.
Always include a plain-text link
Button rendering varies across email clients. Always include the full reset URL as plain text so users can copy/paste it if the button doesn't work. This is especially important for corporate email environments where HTML rendering is restricted.
Send a confirmation after reset
After a password is successfully changed, send a confirmation email to the user's email address. This serves as an audit trail and alerts the user if someone else changed their password.
The confirmation email is a critical security feature, not a nice-to-have. Without it, a user whose password was changed by an attacker has no way of knowing until they try to log in. The confirmation email is the early warning system.
Handle "account not found" securely
Don't tell attackers whether an email address has an account. Instead of showing "no account found" on the reset page, always show "If an account exists with this email, we'll send a reset link." Then send a polite "no account found" email so the actual user knows what happened.
This prevents email enumeration attacks - where an attacker uses the reset flow to discover which email addresses have accounts. The page behavior should be identical regardless of whether an account exists.
Don't include the old or new password
Never include any password information in emails. The email should only contain the reset link or code. Passwords should only be entered on your secure reset page. This seems obvious, but some legacy systems still send passwords via email.
Use a recognizable sender
Send from a consistent, recognizable address (e.g., security@yourproduct.com or no-reply@yourproduct.com). Unfamiliar sender addresses make users suspicious that the email is phishing.
Best practices for sender identity:
- Use your product name as the sender name, not just an email address
- Use the same sender address consistently so users learn to recognize it
- Consider using "security@" for password-related emails to signal importance
- Include your company logo and brand colors for visual recognition
Avoid looking like phishing
Legitimate password reset emails and phishing emails look very similar. Differentiate yours by:
- Using your brand's consistent design and colors
- Sending from a verified, recognizable domain
- Including the user's name and account email
- Never asking for sensitive information in the email itself
- Linking only to your verified domain (no URL shorteners)
- Including a note about how to verify the email is legitimate
Rate-limit reset requests
Limit how many password reset emails a user can request in a given time window (e.g., 3 per hour, 10 per day). This prevents:
- Attackers from flooding a user's inbox with reset emails
- Your email being flagged as spam due to high volume to a single address
- Unnecessary load on your email infrastructure
Password Reset Page Best Practices
The reset email leads to a reset page, and the page experience matters just as much as the email.
Show the user's email address
Display the email address associated with the reset on the password change page. This confirms the user is resetting the right account.
Enforce password strength
Show a real-time password strength indicator. Reject weak passwords before submission, not after. Common requirements:
- Minimum 12 characters
- Not matching common password lists
- Not identical to the email address or username
- Mix of character types (letters, numbers, symbols)
Auto-sign-in after reset
After a successful password reset, sign the user in automatically. Don't make them enter the new password again on a login page - they just set it, they know it. Reducing friction at this point prevents users from immediately forgetting their new password.
Handle expired tokens gracefully
When a user clicks an expired reset link, show a clear message: "This reset link has expired. Click below to get a new one." Include a button to request a new link right on that page. Don't redirect to a generic error page or, worse, the homepage.
Common Password Reset Mistakes
Slow delivery
If your reset emails take more than 10 seconds to arrive, you have an infrastructure problem. Users locked out of their account have zero patience. Investigate your email pipeline and ensure transactional emails are sent through a dedicated, high-priority queue.
Confusing "didn't request this" language
Telling a user "if you didn't request this, your account may be compromised" is alarmist and usually wrong - most unrequested resets are from people who typed the wrong email address. Keep the language calm: "If you didn't request this, you can safely ignore this email."
No confirmation email after reset
Skipping the post-reset confirmation email means users have no way of knowing if someone else changed their password. Always send a confirmation - it's a critical security feature.
Including marketing content
Password reset emails should contain zero marketing content. No product updates, no feature announcements, no discount codes. Users are locked out and frustrated - marketing in this context feels tone-deaf and erodes trust.
Making the reset link look suspicious
Using URL shorteners, unfamiliar domains, or extremely long query strings makes your reset link look like a phishing attempt. Use your primary domain, keep the URL clean, and don't redirect through tracking services.
Measuring Password Reset Performance
| Metric | Target | Action if Below Target |
|---|---|---|
| Email delivery time | Under 5 seconds | Audit email infrastructure |
| Reset completion rate | 85%+ | Check email clarity, button visibility |
| Time to reset | Under 3 minutes | Check delivery speed, page UX |
| Support tickets about resets | Under 2% of resets | Improve email content, handle edge cases |
| Repeat reset requests | Under 10% | Check email deliverability, user experience |
A high repeat reset rate (users requesting multiple resets) usually indicates a deliverability problem - the first email is going to spam or arriving late.
FAQ
How long should a password reset link be valid?
One hour is the standard for user-initiated resets. It's long enough for users to complete the reset but short enough to limit the security window if the email is intercepted. For forced resets (where you initiate the reset), use 24 hours since the user may not see the email immediately.
Should I use a reset link or a reset code?
Links are better for web applications - one click and the user is on the reset page. Codes are better for mobile apps - the user can see the code without leaving the app. The best approach for products with both web and mobile is to include both: a prominent code for mobile users and a link for web users.
How do I prevent password reset emails from going to spam?
Proper email authentication is the foundation. Set up SPF, DKIM, and DMARC for your sending domain. Beyond that, use a dedicated transactional sending infrastructure separate from marketing, keep the email content simple (heavy HTML triggers spam filters), and monitor your sender reputation. For a comprehensive approach, see our email deliverability guide.
Should I tell users why their password was declined?
Yes, but be specific about requirements, not about what's wrong. Say "Password must be at least 12 characters" rather than "Password too short." Show all requirements upfront so users don't have to guess. Never tell users their password is on a common password list by name - just say it's too common.
How do I handle users who request many password resets?
Rate-limit reset requests (e.g., 3 per hour, 10 per day). If a user repeatedly requests resets, the issue is usually one of: the emails are going to spam, the reset link isn't working, or the user is confused by the flow. After 3+ requests, consider showing a "having trouble?" message with direct support contact information.
What about passwordless authentication?
Magic links and passkeys are making traditional passwords increasingly obsolete. If your product supports passwordless login, the password reset flow becomes a magic link flow - simpler for users and more secure. Consider whether you need password reset at all, or whether you can offer passwordless as the primary flow with password reset as a fallback.
Should password reset emails include the user's name?
Yes. Including the user's name ("Hi Sarah") serves two purposes: it confirms the email is for them (not a generic phishing blast) and it adds a personal touch to an otherwise utilitarian email. Use the name they have on file, not their email address handle.
How do I test my password reset flow?
Test the complete flow end-to-end: request, email delivery, link click, password change, confirmation email. Test on multiple devices (desktop, mobile), email clients (Gmail, Outlook, Apple Mail), and browsers. Also test edge cases: expired links, already-used links, multiple simultaneous requests, and account-not-found scenarios.
Password reset emails sit at the intersection of security and user experience - get them right, and you protect accounts while keeping users happy. For sending instant, reliable password reset emails, Sequenzy's transactional email API delivers reset emails in milliseconds with enterprise-grade security and deliverability.