If a website has a reset password facility (which will e-mail the account holder a reset link), does this facility reveal too much information by allowing someone to probe who holds an account by entering various e-mail addresses?

On a login screen you can get around it revealing who holds an account by giving a generic "E-mail or password is incorrect" message when incorrect details are entered. Which could mean an account doesn't exist or that the password is wrong.

The only way I can think of not revealing who holds an account through a password reset link is to provide a generic message saying "You have been sent a reset link to your e-mail address, if you had an account, otherwise you'll need to create a new account" or words to that effect, whether or not a reset link could be successfully sent.

  • 1
    Well.. if you have some sort of an account number, you can ask the user to enter that to retrieve the password.
    – hsnm
    Nov 8, 2012 at 11:57
  • 1
    "too much information" is subjective. How much is too much? You seem to be really asking "Is there a way to prevent an adversary from using the reset password facility to enumerate accounts. In which case as @Tobias states, you've answered your own question.
    – MCW
    Nov 8, 2012 at 14:27
  • 2
    For a very thorough treatment of your question (and other stuff associated with it,) see Troy Hunt's writeup. It will indeed tell you everything you want to know. Nov 8, 2012 at 14:50
  • @hsnm But then you have to have a process for "I forgot/don't have my account number" and you'll likely end up with the same problem.
    – Iszi
    Nov 8, 2012 at 16:45
  • 2
    Unfortunately, if you don't permit duplicate email addresses, your signup screen could be used to do verify them. Nov 9, 2012 at 0:34

3 Answers 3


You already answered the question youself: The only way to not give away any information is to display a generic "A message has been sent to [email protected]" after requesting a passwort reset, even if there is no account associated with that email. See also this question for additional details.


Yes, could be, but application owner could limit the number of attempts from particular IP-addresses. Another layer could be that entered e-mail address validity could be checked in the application database. Another possibility is to ask e-mail address two times and disable clipboard in the second field, so it always should be typed manually.

Otherwise you are absolutely right.


Are you protecting the bank accounts of people involved in illicit transactions? If so, then permitting an adversary to elicit email addresses/credentials is probably unwise.

Are you protecting my display preferences on a public website? If so, then the "reset password" facility is boring.

As someone else has said, all security controls have a cost; the art is to balance cost, risk, and consequence.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .