# Force password reset after login **URL:** \ **Category:** Get Help\ **Tags:** reset-password-prompt-new-experience, login-experience\ **Created:** [October 18, 2024, 8:54pm UTC](https://community.auth0.com/t/force-password-reset-after-login/150116 "2024-10-18T20:54:40Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![caward24](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/caward24/32/58884_2.png) [@caward24](https://community.auth0.com/u/caward24)\ **Post date:** [October 18, 2024, 8:54pm UTC](https://community.auth0.com/t/force-password-reset-after-login/150116/1 "2024-10-18T20:54:40Z")
Hi, Is there a way to force a password reset after a user login? Context: An admin may want to have users reset their passwords the next time they login. I noticed there is an endpoint to force a reset password email, but an email to reset your password coming out of no where or just being locked out of an account seems unintuitive. ---
**Author:** ![ale.vesga1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ale.vesga1/32/60921_2.png) [@ale.vesga1](https://community.auth0.com/u/ale.vesga1)\ **Post date:** [October 18, 2024, 11:07pm UTC](https://community.auth0.com/t/force-password-reset-after-login/150116/3 "2024-10-18T23:07:49Z")
Hi @caward24, Welcome back to the Auth0 by Okta Community! I understand you are worried about the possible friction with having users reset their passwords. These are the solutions I’d recommend: As an Admin, you are able to force a password reset via the Auth0 Dashboard or the Management API. - [DOCS: Change Users’ Passwords](https://auth0.com/docs/authenticate/database-connections/password-change) If you are worried about the flow of the email of the password reset, you could block users from logging in via their “email\_verified” attribute. Users are then forced to use the forgot password flow configured on the Universal Login. This solution is described in this post: - [Require Users to Change Passwords Before Logging in](https://community.auth0.com/t/require-new-users-to-change-password-before-logging-in/112760) Please let me know if there’s anything else I can do to help, I’m glad to clarify further. ---
**Author:** ![caward24](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/caward24/32/58884_2.png) [@caward24](https://community.auth0.com/u/caward24)\ **Post date:** [October 19, 2024, 5:59pm UTC](https://community.auth0.com/t/force-password-reset-after-login/150116/4 "2024-10-19T17:59:43Z")
Just to clarify there are 2 options: 1. Trigger a password reset that sends an email 2. Set the “email\_verified” attribute to false and have a post login flow deny the user if it is false. If these are the options, I would like to talk about the second option. If I use option 2 and user cannot log in, will the user know their password has been changed? Or will they not know and keep typing their old password until they give up and choose forgotten password. ---
**Author:** ![ale.vesga1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ale.vesga1/32/60921_2.png) [@ale.vesga1](https://community.auth0.com/u/ale.vesga1)\ **Post date:** [October 24, 2024, 12:04am UTC](https://community.auth0.com/t/force-password-reset-after-login/150116/5 "2024-10-24T00:04:50Z")
Hi @caward24, Correct the Auth0 recommended options are to - [Trigger an interactive password reset flow](https://auth0.com/docs/authenticate/database-connections/password-change#trigger-an-interactive-password-reset-flow) that sends the user a link through email. The link opens the Auth0 password reset page where the user can enter a new password. - [Directly set the new password](https://auth0.com/docs/authenticate/database-connections/password-change#directly-set-the-new-password) using the Auth0 Management API or the Auth0 Dashboard. There is a third option, which is a bit more complex. Using Triggers, you can manually deny the user via one of the many user attributes. This approach is fully customizable to your needs. Here you can also redirect a user to a [Custom error page](https://auth0.com/docs/customize/login-pages/custom-error-pages). ---
**Author:** ![jmussman](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jmussman/32/53948_2.png) [@jmussman](https://community.auth0.com/u/jmussman)\ **Post date:** [October 28, 2024, 11:26pm UTC](https://community.auth0.com/t/force-password-reset-after-login/150116/6 "2024-10-28T23:26:53Z")
@caward24, I work for Okta Educational Services, and we are always pointing out that sending an email with a link is suspiciously like phishing and hopefully will be ignored if the user is paying any attention. The best all-around solution is to use the API to change the user’s password to some random value so they cannot log in with their old one. Then send them a message that they should go to the sign-on page and use the “I forgot my password” link to change their password. If they follow the message they aren’t getting phished because they are initiating the connection. If they don’t see or ignore the message they simply cannot log in. Then they are very likely to use the “I forgot my password” link to fix the problem anyways. I’ve done that myself at least three times this year where clearly the vendor clearly migrated accounts or removed passwords without telling anyone. This seems to be a typical solution for most applications. I should also point out that the only way to change your Auth0 admin account password is to use the “I forgot my password” link 🙂 ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [November 11, 2024, 11:27pm UTC](https://community.auth0.com/t/force-password-reset-after-login/150116/7 "2024-11-11T23:27:12Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.