Links that expire can be found anywhere from Email Verification to Password Reset procedures, I understand in most cases this is considered "security theater", but wanted to know what a viable time-frame is for a link to be valid?

Is 10-15 minutes acceptable? With all the unknown factors of email delays etc?

Is a shorter duration considered more secure? Thanks.

  • In my experience 24-hours is more command that 10-15 minutes, for exactly the reason you say
    – paj28
    Sep 25, 2015 at 8:42
  • 1
    I think that this question is impossible to answer without understanding the security requirements of the entire system and what functionality the links provide. Perhaps if you reword it to something like "What are the factors to consider when determining how long the delay should be?" you would get more help. Sep 25, 2015 at 16:11
  • @NeilSmithline how about the functionality mentioned above "Email Verification and Password Reset" scenarios, and also the site does have personal "sensitive" information. And you are correct, I do want to know the factors to consider as I already know a few which make that timeframe nearly impossible.
    – bfritz
    Sep 25, 2015 at 21:08
  • Password rest - web services best practices is a useful related answer. But not an answer to your question.
    – RoraΖ
    Oct 1, 2015 at 11:35

1 Answer 1


IMHO 10-15m is too short for almost all cases.
It practically excludes almost all delayed deliveries e.g. due to

  • greylisting (quite widespread anti-spam technique)
  • temparary overloads or temporary network problems

RFC1123/5.3.1 recomends delivery retries no more often than 30 minutes.
Anyway very short timeout (2-5 minutes) may make some sense in higher security procedures.

Not the answer you're looking for? Browse other questions tagged .