Build a secure password reset

Prompt that plans password resets with short-lived links, neutral answers and ended sessions. Paste it into an AI tool of your choice, which then plans the reset flow.

Topic: Apps & prototypes
Type: Prompt
Level: Intermediate
Time: about 10 min

Results depend on the tool, the model and what you enter.

Result preview

Example: written by our editors, not real AI output.

Flow 1. Request with email → always the same answer: "If an account exists, an email is on its way." 2. Token: 32 random bytes, stored only as a hash, valid 30 minutes, single use 3. Limit: 5 requests per hour per address 4. New password set → all other sessions ended, notice email to the account Test cases: expired link → error page with new link; link used twice → rejected; token altered → rejected

Fill in

What you type stays in this browser window. We store and send nothing.

ApplicationWhat is the account for?

StackWhat do you work with?

Special caseWhat needs attention?

Your prompt

Plan the password reset flow.
Application: [Application]
Stack: [Stack]
Special case: [Special case]
Approach: 1. Create a long random token per request, store only its hash, and let it expire after a short time and after a single use. 2. Always answer the same way whether or not the email address is known, and limit requests per address and per network. 3. Send only a link, never a password, and explain in the email what to do if nothing was requested. 4. After the new password is set, end all other sessions and notify the account about the change. 5. Define what gets logged without storing tokens or passwords. 6. List tests for expired, reused and tampered links.
Output: the flow as a numbered list, data fields, email text and test cases. Mark assumptions as assumptions.

Take particular care to reveal nothing that helps an attacker and let every link be short-lived and single-use.

Before you answer, check: Are all instructions met? If key information is missing or a placeholder in square brackets is still in the text, ask instead of guessing. Mark assumptions as assumptions.

Plan the password reset flow.
Application: [Application]
Stack: [Stack]
Special case: [Special case]
Approach: 1. Create a long random token per request, store only its hash, and let it expire after a short time and after a single use. 2. Always answer the same way whether or not the email address is known, and limit requests per address and per network. 3. Send only a link, never a password, and explain in the email what to do if nothing was requested. 4. After the new password is set, end all other sessions and notify the account about the change. 5. Define what gets logged without storing tokens or passwords. 6. List tests for expired, reused and tampered links.
Output: the flow as a numbered list, data fields, email text and test cases. Mark assumptions as assumptions.

Take particular care to reveal nothing that helps an attacker and let every link be short-lived and single-use.

Before you answer, check: Are all instructions met? If key information is missing or a placeholder in square brackets is still in the text, ask instead of guessing. Mark assumptions as assumptions.

This is an instruction for an AI, not the result itself.

Where this prompt works

These AI tools are a good fit for this prompt:

How to use it

Fill in the fields or tap a suggestion. Leave out names, addresses and other personal data.
Copy the finished prompt into an AI tool of your choice.
Request a link twice in quick succession and use the first one. It must no longer work, and the second must work exactly once.

Why does this work?

Password resets open many gaps: links that never expire, answers that reveal who is a customer, and sessions that keep running after the change. Fixed rules for tokens, answers and sessions close them.

Tips

Do not enter real tokens, password hashes or user data into the AI tool; sample values are enough.

You may use our prompts freely, including at work. Please do not republish them as your own collection. We give no warranty for AI results; check them yourself. Terms of use

Build a secure password reset

Result preview

Fill in

Your prompt

Where this prompt works

How to use it

Why does this work?

Tips

Also a good fit

Choose pagination for an API list New

Write an API reference people can use right away New

Plan a throttled data backfill New