… an actor attempts to sign in, but cannot provide their password. The credential is forgotten, lost, or compromised, and the actor needs a dependable path to confirm identity and regain access without creating an unlinked duplicate account.
Problem
When an actor cannot provide their primary credential, they lose access to their work and settings in the artifact. Without a clear recovery path, the actor is locked out, abandons the task, or creates unnecessary duplicate accounts.
Account recovery is needed whenever an interface relies on passwords or device-specific credentials. Systems that rely on passwordless access or federated sign-in avoid this problem by eliminating memorised secrets altogether. Where passwords remain in use, an effective recovery flow relies on an independent communication channel that the actor already controls—such as a verified email address or phone number—to re-establish access securely.
Solution
Provide an accessible recovery path on the sign-in interface: verify identity through an alternative communication channel or stored recovery code, confirm requests neutrally without revealing whether an account exists, and guide the actor to set a new credential upon verification. When those routes fail, offer a route to a person.
Once the credential is reset, sign the actor in automatically and offer to sign out of any other active sessions.
Continuation
The actor verifies their identity through an alternative communication channel and sets a replacement credential. Check requirements on the new secret as the actor types using validation before restoring access. When every automated route fails, because the actor has lost the email address or phone the flow relies on, the flow ends in reaching a person who can restore access, rather than in an error…
All connections
- Enacts
- Agency — returns control over personal work and settings to the actor when primary credentials fail
- Learnability — provides clear instructions for regaining access without dead ends
- Complements
- Account access — An actor attempts to sign in, but cannot provide their password.
- Validation — Check requirements on the new secret as the actor types using validation before restoring access.
- Preceded by
- Password
- Enabled by
- Reaching a person — When every automated route fails, because the actor has lost the email address or phone the flow relies on, the flow ends in reaching a person who can restore access, such as a recovery contact the actor named, a workspace admin or the provider's support, rather than in an error
In practice
Neutral confirmation messages
When an actor submits an email address or phone number for recovery, display a neutral confirmation message: “If an account matches this address, we have sent instructions to reset your password.” This prevents account enumeration while reassuring the actor. To help actors detect typos, display the entered address on the confirmation screen with an option to edit and resubmit it.
Session revocation and change notices
After the actor resets their credential, send a confirmation notice to their verified email address or phone number. Offer a prompt to sign out of all other active sessions, ensuring that old or compromised devices lose access.
Resources & references
- Vitaly Friedman (2022). Authentication UX Design Guidelines
- UI Patterns: Account Registration