A Practical Checklist for Testing Password-Reset Emails

Password-reset email is part of an account's security boundary. Testing should cover not only whether a message arrives, but also what happens when links expire, requests repeat, and an attacker tries to reuse a token.

Delivery and content

Confirm that the message arrives at the intended address, uses the expected brand and domain, and clearly explains why it was sent. The link should use HTTPS and lead to the correct site. Do not include the user's existing password in the message.

Token behavior

Reset tokens should be unpredictable, short-lived, and single-use. Test an expired token, a previously used token, and a token associated with another account. A successful reset should invalidate outstanding reset tokens as appropriate. Avoid placing secrets in analytics events or server logs.

Abuse resistance

Rate-limit repeated reset requests, and avoid revealing whether an email address belongs to an account. Provide a useful confirmation screen without leaking account existence. Check that changing the password triggers appropriate notifications and session handling.

Testing safely

Use test accounts and controlled mailboxes; never test with other people's accounts. Disposable inboxes can help with non-production delivery checks, but use durable test mailboxes when you must revisit historical messages or audit the flow.