# Account Recovery Learn how FusionAuth lets users reset a forgotten password by email or text message, and how recovery interacts with MFA, sessions, and account lockout. > For the index of this section of the site, see [llms.txt](https://fusionauth.io/docs/llms.txt) When users forget a password, FusionAuth sends them a link to choose a new one. This forgot password workflow is the account recovery process for password users. The workflow runs on the [hosted login pages](https://fusionauth.io/docs/concepts/integration-points.md#hosted-login-pages), or in your own pages through the [Forgot Password API](https://fusionauth.io/docs/apis/users/forgot-password.md) and the [Change Password API](https://fusionauth.io/docs/apis/users/change-password.md). ## The Forgot Password Workflow The workflow has two steps. First, the user asks for a reset, and FusionAuth sends a message containing a change password Id. Then the user opens the link in the message and sets a new password: ```mermaid sequenceDiagram actor User participant FusionAuth participant Inbox as Email or phone User ->> FusionAuth : Click "Forgot your password?" and enter a login Id FusionAuth ->> Inbox : Send a link with a change password Id FusionAuth ->> User : Show the "message sent" page User ->> Inbox : Open the link Inbox ->> FusionAuth : Load the change password page opt The user has MFA enabled FusionAuth ->> User : Ask for a second factor end User ->> FusionAuth : Submit a new password FusionAuth ->> User : Log the user in, or show the "password changed" page ``` The forgot password workflow on the hosted login pages. The hosted login pages use four [theme templates](https://fusionauth.io/docs/theme/advanced-themes.md#templates) for the workflow: * `passwordForgot` at `/password/forgot` collects the login Id. * `passwordSent` at `/password/sent` confirms that FusionAuth sent the message. * `passwordChange` at `/password/change/{changePasswordId}` collects the new password. * `passwordComplete` at `/password/complete` confirms the change. When the user starts the workflow from an OAuth login, FusionAuth completes the login after the password change. The user then returns to your application without logging in again. Otherwise, FusionAuth shows the `passwordComplete` page. ## Email and Text Message Delivery Available since `1.59.0` Recovery by text message. FusionAuth chooses the delivery method from the identity the login Id matches: * A login Id that matches an email address or username sends an email to the user's email address. * A login Id that matches a phone number sends a text message to that number, through the Tenant's messenger. Both messages contain the same kind of link. FusionAuth doesn't send a code for the user to type in. The [Tenant](https://fusionauth.io/docs/concepts/types/tenants.md) sets one template for each delivery method in the **Forgot password** template settings. An [Application](https://fusionauth.io/docs/concepts/types/applications.md) can override either template, for example to brand the message for that application. See [Application-Specific Email Templates](https://fusionauth.io/docs/email/configuring-application-specific-email-templates.md). For the template variables, see the [email template reference](https://fusionauth.io/docs/email/template-reference.md#forgot-password) and the [message template reference](https://fusionauth.io/docs/messengers/template-reference.md#forgot-password). The Tenant templates also turn the workflow on. Without a Tenant template for a delivery method, the workflow is off for that delivery method, even when an Application sets an override. See [Turn Off Forgot Password](https://fusionauth.io/docs/users/account-recovery/turn-off-forgot-password.md). ## The Change Password Id The change password Id in the link identifies the user. The Id follows these rules: * The Id expires 10 minutes after FusionAuth creates the Id. To change the lifetime, set **Change password** in the Tenant's [external identifier durations](https://fusionauth.io/docs/concepts/types/tenants.md#external-identifier-durations-form-fields). * The Id works once. A successful password change deletes the Id. * A new forgot password request deletes the user's earlier Ids, so only the newest link works. Anyone who holds a valid Id can set the user's password. Treat the Id like a password. ## Recovery and MFA A user with [multi-factor authentication](https://fusionauth.io/docs/authentication/multi-factor-authentication.md) enabled must pass an MFA challenge before FusionAuth accepts a new password. A link in an email or text message proves access to that inbox or phone, and the second factor proves the rest. Without this check, an attacker who controls the user's inbox could take over an account that MFA protects. On the hosted login pages, FusionAuth asks for the second factor before the change password form. A browser that the user already trusts from an earlier MFA login skips the challenge. After the password change, the user doesn't see a second MFA prompt during login. With the API, the Change Password API returns the `[TrustTokenRequired]` error for these users. Your code must first complete an MFA challenge to get a trust token. See [Build a Password Reset Flow With the API](https://fusionauth.io/docs/users/account-recovery/api.md#handle-users-with-mfa). MFA [recovery codes](https://fusionauth.io/docs/authentication/multi-factor-authentication.md#recovery-codes) cover a different problem: a user who knows the password but lost the second factor. ## What Changes After a Reset A successful password change has these effects: * FusionAuth revokes the user's refresh tokens. To keep refresh tokens, turn off **On password change** in the Tenant's [refresh token settings](https://fusionauth.io/docs/concepts/types/tenants.md#refresh-token-settings). * FusionAuth clears a required password change on the user. * FusionAuth can unlock an account that too many failed logins locked. To allow the unlock, enable **Cancel action on password reset** in the Tenant's [failed authentication settings](https://fusionauth.io/docs/security/account-protection/account-lockout.md). * FusionAuth can mark the email address or phone number that received the link as verified, depending on the Tenant's identity verification settings. The new password must meet the Tenant's [password rules](https://fusionauth.io/docs/concepts/types/tenants.md#password-settings). When [breached password detection](https://fusionauth.io/docs/security/account-protection/breached-password-detection.md) is on, FusionAuth also rejects a password that appears in a known breach. ## Notifications and Events > **PLAN:** This feature requires [an Enterprise plan](https://fusionauth.io/docs/concepts/plans-and-limits/plans-features.md#enterprise-features). FusionAuth can tell the user that the password changed with the **Password reset success** email or message template. FusionAuth also sends these webhook events during the workflow: * [user.password.reset.start](https://fusionauth.io/docs/events/reference/user/password/user-password-reset-start.md) when a user starts the workflow. * [user.password.reset.send](https://fusionauth.io/docs/events/reference/user/password/user-password-reset-send.md) when FusionAuth sends the message. * [user.password.reset.success](https://fusionauth.io/docs/events/reference/user/password/user-password-reset-success.md) when the user sets the new password. A reset doesn't send [user.password.update](https://fusionauth.io/docs/events/reference/user/password/user-password-update.md). That event covers password changes outside the forgot password workflow. ## Security The hosted forgot password page shows the same confirmation whether or not the account exists, so the page doesn't reveal which accounts exist. With an API key, the Forgot Password API returns a `404` for an unknown user. If you build your own page, show the same confirmation for every response. See [Account Enumeration](https://fusionauth.io/docs/security/account-protection/account-enumeration.md). To slow down attackers who send many requests, use the [rate limit and CAPTCHA](https://fusionauth.io/docs/security/account-protection/advanced-threat-detection.md) settings. Both require the Enterprise plan. The forgot password rate limit is off by default. When the limit is on, FusionAuth allows 5 requests per user every 60 seconds by default. ## Other Ways to Set a Password The forgot password workflow also covers these cases: * Your support team can send a reset link from the Admin UI. See [Send a Password Reset](https://fusionauth.io/docs/users/user-support-guide.md#send-a-password-reset). * An administrator can require a password change at the user's next login. See [Require a Password Change](https://fusionauth.io/docs/users/user-support-guide.md#require-a-password-change). * When you create a user without a password, FusionAuth can send a link to set one up. The link uses the **Set up password** template and lasts 24 hours by default. See **`sendSetPasswordIdentityType`** in the [Create a User API](https://fusionauth.io/docs/apis/users/create.md). A user that an [identity provider](https://fusionauth.io/docs/authentication/identity-providers.md) created without an email address or username can't use the forgot password workflow. See [Anonymous Account Limitations](https://fusionauth.io/docs/authentication/identity-providers.md#anonymous-account-limitations). [Hosted Login Pages Learn how to let users reset a forgotten password by email or text message on the FusionAuth hosted login pages.](https://fusionauth.io/docs/users/account-recovery/hosted-pages.md) [APIs Learn how to build your own forgot password pages with the Forgot Password and Change Password APIs, including users with MFA.](https://fusionauth.io/docs/users/account-recovery/api.md) [Turn Off Forgot Password Learn how to turn off the forgot password workflow for a FusionAuth tenant and hide the forgot password link on the hosted login pages.](https://fusionauth.io/docs/users/account-recovery/turn-off-forgot-password.md) Related [Users Build a Password Reset Flow With the API Learn how to build your own forgot password pages with the Forgot Password and Change Password APIs, including users with MFA. account recoveryforgot passwordpassword reset](https://fusionauth.io/docs/users/account-recovery/api.md) [Users Let Users Reset Passwords on the Hosted Login Pages Learn how to let users reset a forgotten password by email or text message on the FusionAuth hosted login pages. account recoveryforgot passwordpassword reset](https://fusionauth.io/docs/users/account-recovery/hosted-pages.md) [Users Turn Off Forgot Password Learn how to turn off the forgot password workflow for a FusionAuth tenant and hide the forgot password link on the hosted login pages. account recoveryforgot passwordpassword reset](https://fusionauth.io/docs/users/account-recovery/turn-off-forgot-password.md) [APIs Change a User's Password API API documentation for the FusionAuth Change a User's Password API. change passwordpassword resetforgot password](https://fusionauth.io/docs/apis/users/change-password.md) --- ## Other pages in Users > For the full index of this section, see [Users](https://fusionauth.io/docs/llms-users.txt). - [Self-Service Account Management](https://fusionauth.io/docs/users/account-management.md): Setting up multi-factor authentication as an admin and user, as well as configuring the self-service account management pages. - [Custom Admin Forms](https://fusionauth.io/docs/users/admin-forms.md): How and why to customize forms in the Admin UI. - [CleanSpeak Integration](https://fusionauth.io/docs/users/cleanspeak.md): Learn about CleanSpeak integration. - [Register](https://fusionauth.io/docs/users/register.md): Learn about FusionAuth's registration options. - [Search](https://fusionauth.io/docs/users/search.md): Learn about search options within FusionAuth. - [Tenant Manager App](https://fusionauth.io/docs/users/tenant-manager.md): Limit an individual to administering the users of only one tenant in a multi-tenant configuration. - [How To Use User Actions](https://fusionauth.io/docs/users/user-actions.md): Learn how you can use User Actions to apply attributes to your users. - [User Support Guide](https://fusionauth.io/docs/users/user-support-guide.md): Learn about customer support operations on users in the FusionAuth Admin UI.