Password Reset Notifications

Security-first password reset

Password reset is a security-critical flow. A poorly implemented reset can be a major vulnerability. Sendivent helps you get it right:

• Deliverability matters — if the reset email lands in spam, users can't recover their account
• Speed matters — every second of delay frustrates users and increases support tickets
• Backup channels — SMS provides a reliable fallback when email fails

Complete password security flow

Beyond the reset itself, consider the full security notification flow:

1. password.reset — the reset link email/SMS
2. password.changed — confirmation after successful reset
3. login.new_device — alert when logging in from unknown device
4. login.suspicious — alert for unusual login patterns

Each notification reinforces account security and builds user trust. For a complete picture of critical user notifications, see our user onboarding guide.

Implementation with Sendivent

Email Template

<h2>Reset your password</h2>

<p>Hi {{user.name}},</p>

<p>We received a request to reset your password. Click the button below to choose a new one:</p>

<a href="{{payload.resetUrl}}" style="...">Reset Password</a>

<p><strong>This link expires in {{payload.expiresIn}}.</strong></p>

{{#if payload.requestedFrom}}
<p style="color: #666; font-size: 12px;">
  Requested from IP: {{payload.requestedFrom}} at {{formatDate payload.requestedAt "MMM D, h:mm A"}}
</p>
{{/if}}

<p>If you didn't request this, you can safely ignore this email.</p>

SMS Template

Your {{payload.appName}} password reset code: {{payload.code}}. Expires in {{payload.expiresIn}}. Don't share this code.

Triggering the notification

await sendivent
  .event('password.reset')
  .to({ email: user.email, phone: user.phone })
  .payload({
    resetUrl: `https://app.example.com/reset?token=${token}`,
    code: shortCode,  // For SMS
    expiresIn: '1 hour',
    appName: 'YourApp'
  })
  .send();

Best practices

• Always include when and where the reset was requested
• Set short expiration times (1 hour max)
• Send confirmation when password is actually changed
• Consider SMS for high-security accounts
• Implement rate limiting in your application to prevent abuse

Ensure your password resets actually land. Create a free account and get enterprise-grade deliverability backed by AWS SES. The password.reset event template is ready to go—just wire it up.