Password Reset Email: How to Set One Up for Your SaaS
Set up a password reset email for your SaaS with Claude Code: how the reset flow works, security basics, what to tell Claude Code and a sample email.
Quick answer
A password reset email sends a user a private, single-use link to a page where they choose a new password. To set one up, connect an email service, then ask Claude Code to build the forgot-password flow with links that expire within an hour, the same on-screen message for every address, and a confirmation email afterward.
Last checked: October 2026
On this page
Adding a "Forgot password?" link to your SaaS means your project has to send a password reset email the moment someone asks for one. It's one of the first emails your users will need, and they need it most when they're locked out.
This guide covers how the reset flow works, the security basics worth getting right, the exact message to send Claude Code, a sample email, and how to test everything before launch. You won't write any code. Claude Code builds it, and you check the result.
How does password reset work?
Password reset works by emailing the user a private, one-time link that proves they own the address on the account. Clicking the link opens a page where they choose a new password.
Here's the full flow:
| Step | What the user sees | What your project does |
|---|---|---|
| 1 | Clicks "Forgot password?" and enters their email | Creates a reset token (a long, random code) tied to that account |
| 2 | Sees "If an account exists, we've sent you a link" | Sends the password reset email with the token inside the link |
| 3 | Clicks the button in the email | Checks the token is real, unused and not expired |
| 4 | Types a new password twice | Saves the new password and cancels the token |
| 5 | Gets a "your password was changed" email | Sends the confirmation and asks them to sign in again |
The reset email is a transactional email: a one-to-one message your project sends because of something the user did, as opposed to a newsletter or promotion. It's one of the transactional emails most SaaS products need.
What security basics should a password reset email follow?
The most important rule is that reset links expire quickly and work only once. The OWASP Forgot Password Cheat Sheet, a widely used security reference, lists both as core protections, along with hard-to-guess tokens and the same response for every address.
Ask Claude Code to build in each of these:
| Basic | What it means | Why it matters |
|---|---|---|
| Expiring links | The link stops working after a short time. We suggest an hour or less | A link left in an old inbox can't be used later |
| Single use | Once used, the link stops working | A forwarded or leaked email can't reset the password again |
| Hard-to-guess tokens | The code in the link is long and randomly generated | Nobody can guess their way into an account |
| Same message for every address | The page says the same thing whether or not the email has an account | Strangers can't use your form to find out who has signed up |
| Request limits | Only a few reset requests per account in a short time | Stops someone flooding a user's inbox with reset emails |
| No passwords in email | The email never contains the old or new password | Email isn't a safe place to keep a password |
| Confirmation afterward | A second email says the password was changed | The real owner spots a change they didn't make |
OWASP also advises against locking an account because someone requested a reset, and suggests signing the user out of other devices after the change, or offering to.
What should you tell Claude Code to set up password reset emails?
Tell Claude Code what you want the user to experience, plus the security basics above. It works out the pages, the sending code and the emails.
First, connect an email service so your project can send. Here's how to connect SimpleSends:
- Sign up on the SimpleSends website and follow the steps there to set up the email address you'll send from. To send from your own domain, this includes adding a few DNS records (settings that show inboxes your domain allows these emails) where your domain is registered.
- In Claude Code, open Customize, then Connectors, choose Add, then Add custom connector, and fill in:
| Field | What to enter |
|---|---|
| Name | SimpleSends |
| MCP server URL | https://mcp.simplesends.com/mcp |
- When Claude prompts you to connect, log in to SimpleSends.
- Back in the Claude Code chat, tell Claude Code: "I've connected SimpleSends for all transactional email." It takes it from there, including adding what your project needs to send email.
A connector lets Claude Code work with another service while you build. It uses MCP, a shared standard for plugging tools into AI assistants. Here's what MCP is, in plain English.
Then send your brief:
Please add a "Forgot password?" option to my sign-in page. When someone enters their email, show the same message whether or not they have an account, and send them a password reset email with a button that opens a page to choose a new password. Make the link work once and expire after one hour, and limit how many reset emails one address can request. Ask for the new password twice. Afterward, send a short "your password was changed" email and ask them to sign in again. Show me both emails before you build anything.
You'll get a preview of both emails and a short plan of the pages Claude Code will add. Ask for any changes in plain words, then let it build.
If your sign-in runs on Supabase
Many projects built with Claude Code use Supabase Auth for sign-in, and Supabase sends its own reset emails. Its built-in sender is for testing only. It delivers only to addresses on your Supabase team and, as of October 2026, is limited to 2 emails an hour. Before launch, send those emails through your own email service.
My sign-in uses Supabase Auth. Please send Supabase's password reset and other sign-in emails through SimpleSends instead of Supabase's built-in sender, with my own design and wording.
What does a good password reset email look like?
A good password reset email is short, clearly from you, and has one obvious button. Here's a sample you can hand to Claude Code or adapt. For more wording options, see our password reset email templates.
SubjectReset your YourCompany password
Hi,
We got a request to reset the password for your YourCompany account. Use the button below to choose a new one.
This link works once and expires in 1 hour.
If you didn't ask for this, you can ignore this email. Your password won't change.
The YourCompany team
And the confirmation that follows:
SubjectYour YourCompany password was changed
Hi,
The password for your YourCompany account was changed on October 5 at 2:14 p.m.
If this was you, there's nothing else to do.
If it wasn't you, reset your password now and contact us at support@yourcompany.com.
What makes these work:
- The subject says exactly what it is, so people find it fast and trust it.
- One button, no promotions. Supabase's own guidance is to keep sign-in emails free of marketing content and extra links.
- The expiry is stated, so nobody is surprised when an old link stops working.
- A "didn't ask for this" line reassures the real owner if someone else typed their address.
- It comes from your own domain, such as hello@yourcompany.com. Here's how to choose your sending domain and from address.
If you'd rather skip passwords altogether, magic link login uses a similar email to sign people in directly.
How do you test your password reset flow?
Test with real accounts before launch, and check every path, not only the one where everything goes right.
| Test | What should happen |
|---|---|
| Request a reset for your own account | The email arrives within a minute and the button opens the reset page |
| Request a reset for an address with no account | The same on-screen message appears, and no email is sent |
| Click the same link twice | The second click shows "this link has expired or been used" |
| Use a link after it expires | The same message, with a way to request a new link |
| Finish a reset | The "password changed" email arrives |
| Open both emails on your phone | The button is big enough to tap and nothing is cut off |
To test expiry without waiting an hour, ask for a temporary change:
Send test password reset emails to hello@yourcompany.com. For testing only, make the reset link expire after two minutes so I can check the expired message, then set it back to one hour.
If an email doesn't show up, ask Claude Code. With SimpleSends connected, it can read your send logs and delivery status, tell you whether the email went out, and help work out why it didn't arrive. For more, see how to check whether your emails actually sent and how to test your emails before your users see them.
Frequently asked questions
Why isn’t my password reset email arriving?
The usual causes are a typo in the address, the reset never being triggered, or the email landing in a spam or promotions folder. Ask Claude Code to check. With SimpleSends connected, it can read your send logs and tell you whether the email went out and what happened to it.
Can I email users their new password instead of a link?
No. Email isn’t a safe place to keep a password, because messages sit in inboxes for years and can be forwarded or read by anyone with access. Send a link that lets the user choose their own password, and never include the old or new password in any email.
Should the reset link sign the user in automatically?
It’s safer not to. OWASP advises sending users to the normal sign-in page after they set a new password, because signing them in automatically adds complexity where security mistakes tend to creep in. Ask Claude Code to show a “password changed, please sign in” message instead.
Can I use a code instead of a reset link?
Yes. Some products email a short code that the user types into the reset page instead of clicking a link. The same rules apply: the code should be random, work once and expire quickly. Tell Claude Code which you prefer, and it can build either.
Do password reset emails need an unsubscribe link?
A password reset email is transactional: it’s sent because the user asked for it, so it isn’t a newsletter and doesn’t usually carry an unsubscribe link. Keep it that way by leaving out promotions, offers and extra links, so it stays a pure account email.
Sources (2)
- Forgot Password Cheat Sheet(checked October 5, 2026)
- Send emails with custom SMTP (Supabase Docs)(checked October 5, 2026)
Keep reading
More on Task guides →How to Send a Welcome Email to New Users Automatically
How to send a welcome email to new users the moment they sign up: what to include, how it’s triggered, what to tell Claude Code, and how to test it.
6 min read
Email Verification for Sign Ups: Add It With Claude Code
Add email verification for sign ups with Claude Code: how the flow works, what to tell Claude Code, a sample email, and how to handle unverified users.
7 min read
How to Send Email When a Form Is Submitted
Send email when a form is submitted: get every entry in your inbox and a confirmation to the person, built by Claude Code from a plain-English brief.
6 min read