Password Reset Mechanism

Tips:

• Optional: Challenge question
• Optional: 2FA for reset too
• Reset only after confirmation
• Use captcha
• Password reset link with embedded GUID with expiry
• Delete token after reset
• Include reset warning in email
• Only allow reset by email
• Send email after reset too
• Monitor cancellations
• Use HTTPS

NOTE: Email is not E2EE. SMTP-TLS is E2EE between a user and a server, not between users. Signal protocol, for example is.

More (similar) info: https://www.troyhunt.com/everything-you-ever-wanted-to-know/