Is it alright to keep an account locked after the password reset? Say, for example, I have an account locking mechanism that will lock the account for 5 minutes after 3 tries.

Now the user performs a password reset and is successful. Should I keep the account locked and wait for the 5 minutes to complete or should I already unlock the account?

  • 1
    I would unsubscribe from a service that keeps me locked in the scenario you described. Why do you even consider this? Do you hate your users? (Joking aside, IMO it’s a bad idea)
    – Rik D
    May 7, 2019 at 5:26
  • What's your reason for maintaining the lock?
    – schroeder
    May 7, 2019 at 14:56
  • @Rik D. I want to make the site secure and this will serve as punishment for forgetful users hehe. yeah I see what you mean. I'll get this fixed and not justify it further.
    – chip
    May 8, 2019 at 1:21
  • @schroder, my app by default works this way. I am just trying to see if this is ok but apparently it is not and would have to change the implementation.
    – chip
    May 8, 2019 at 1:22

1 Answer 1


This depends on why the account was locked in the first place.

If the account was locked due to too many failed login attempts and the password reset procedure is also used to "recover" forgotten passwords (as in, the 'forgot password' link on the login screen sends the user into the password reset procedure), then it serves no purpose at all to keep the account locked after the password was reset successfully.

On the other hand, if the account was locked for administrative reasons (for example, the user got a temporary ban due to misconduct), then a password reset should definitely not unlock the account.

And there are many other situations somewhere in-between.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .