When a site gets hacked, or otherwise, the web site forces you to change your password. This is done by simply telling you to change your password, not enforcing it.

Why do they do that? For instance, they could:

  1. Disable your credentials, and send you an e-mail for password reset.
  2. In case you missed the email - or you aren't using the service very often and chose to ignore the password reset email - just keep the account deactivated until sign in is attempted, then send the password reset email, with hyperlinks to report possible unauthorized sign-in tries.

2 Answers 2


I've implemented the functionality you describe in the past as follows: Along with every account in the database, a Boolean value is stored. This property might for instance be named IsPasswordChangeRequired.

When the sign in form is submitted, the web server first checks whether the user credentials are valid. If this is the case, it checks the value of the IsPasswordChangeRequired property. When that's true, an alternative version of the sign in form is served, i.e. one that contains fields to enter a new password.

The server could also respond by redirecting to a change password page.

  • I would argue that your approach is not correct , from the assumption that the hashes are leaked , how do you verify that the guy who is requesting a password reset is your true user?
    – blended
    Commented May 21, 2014 at 15:55
  • 1
    @blended "Not correct" is overreaching. It is a correct procedure. Your concern is about validating the user, which is easily done on the 'change password page' that Steven mentioned.
    – schroeder
    Commented May 21, 2014 at 18:49
  • 1
    @blended Your comment is a bit unclear: Do you think my approach is correct or incorrect? The hashed passwords need to be stored somewhere. If not, the identity provider can't authenticate sign in attempts. Password resets result in an email to the user, containing a URL that allows them access to the change password page (that is, a change password page for which you don't need to be signed in). To access the email, the user needs to have access to his email account. The URL can only be used once: It contains a token that's verified by the web server. Commented May 22, 2014 at 5:28
  • @StevenVolckaert i agree like with your comment ,in your main answer i did not read e mail, so i thought you skip that part
    – blended
    Commented May 22, 2014 at 5:55
  • So... you are trusting the password you believe is insecure and needs to be changed to verify the password reset? Why bother changing it in the first place then.
    – user36976
    Commented May 24, 2014 at 8:10

Sending an email to a user to advise of security issues is not always the best idea.

  • The user's email account might be compromised, e.g. if the same details are used (which many do);
  • The user's email account might have been compromised, and changed the email address in response;
  • The user may dismiss the email as spam or a phishing attempt.

Regarding why some services don't force a password change. This inevitably comes down not compromise the usability: If a customer feels that the work needed is more hassle than it is worth, you've lost a customer. If you give customers the choice, then if for any reason their details are used maliciously then at least the customer had the choice to change them but did not.

  • the question was about when password MUST change , why not enforcing it? As you put a lot of weight in the possibility the e mail to be also compromised, if you think that the risk is high then other measures should be taken from the beggining , like 2FA , or mobile verification
    – blended
    Commented May 21, 2014 at 16:00
  • 2
    Mobile verification is not always an option. All good and well if you have already captured the users contact details but would you use this if you were having to request a mobile number at the point of password reset? How do you know you are not actually verifying someone trying to gain access to the account. Also how many sites implement 2 factor authentication? Some of the bigger services yes but they are n the minority. Although such options are good when thought of but usually they are an after thought
    – Peter
    Commented May 21, 2014 at 16:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .