Are you crafting a new password reset email or updating an existing message? Before you begin designing your content or download a template, read this post. We have gathered information on what to do, what to avoid, and what you can learn from emails from several well-known companies. The best practices, reviewed examples, and recommendations will help you to quickly and easily create an efficient password reset email template.
The most important things to remember
The reset password message is a part of a corresponding workflow, which should be thoroughly designed and tested.
First and foremost is user security. Password management is about users’ data and access to third-party services. The workflow you build must prevent all possibility of a data breach.
Security rules
- Never send passwords via email. This is true for all types of messages, not only for changing passwords. We are pretty sure that one day you have received a welcome message or a password reset confirmation displaying your username and password in plain text. That is the worst possible practice.
- Limit the time of a reset password link validity. There is no standard for the password reset expiration time. The general recommendation is from 20 minutes to one hour for financial, critical, social, and messaging apps. For most apps we have inspected, such a link is valid for 24 hours.
- Give your users information about what to do if they received a password change message that they haven’t requested. It is common to ignore such a message. But for extra security, it might be good to recommend that users change their password or contact support.
- Take care of the security and reputation of the SMTP server/domain you use for sending emails. Use proper encryption methods and set up DMARC, DKIM, and SPF records. Refer to the series of articles on the SMTP security on our blog for more details.
Usability rules
Once the whole process is secure, focus on creating an optimal user experience. Reflect on your own experiences when you have been in the middle of sending a message or reviewing the details of a booking, and you needed to recover a password. At that moment, you wanted the process to be as quick as possible, didn’t you? Here are some tips that can help:
- Make sure your email template is straightforward. It should be obvious to the user that the password reset email comes from your app. So, write a clear email subject line like: “YouApp: Reset your password”. This is not the place for creativity. Provide clear, comprehensive instructions for the steps a user needs to take to regain access to your app.
- Keep your message simple. Don’t fill it with marketing elements and extra links. Include only important instructions written in a brief, friendly text, along with a button to click, as well as a link – and that’s all.
- Maintain a balance between security and simplicity. Don’t include too many steps or too many rules in the reset password process.
- Test to make sure the workflow works, that emails are sent, and that they are displayed as designed. Follow the rules of coding an HTML email template.
- Test email deliverability, and do your best to prevent emails from going to spam. Those moments of waiting for password reset emails to arrive are especially long.
These are the main recommendations to follow when establishing a reset password workflow. Now let’s go into detail and review several reset password emails sent by popular companies.
To learn about what to add to your password reset email, visit the Mailtrap blog.