Reset password - Send email when account does not exist

[jeff15]

Feature: If a user goes through reset password flow and enters an email that does not have an associated account, they should get an email letting them know this email address is not associated with an account.

Use-case: Tell us what you are building. How would the feedback/feature improve your experience?

This would help users know that they might be trying to log in with the wrong email address. This practice is followed by many other websites, including HumbleBundle, and has been asked about by other Auth0 users here…

Notify user that email used to reset password does not exist in our system?

We have some users than attempted to login with emails that don’t exist in the system anymore, and after trying to reset password (successfully), they are saying that they never received the reset password email (by design). Is there a built-in way to notify these users via the attempted email to contact support, etc.? Assuming that there’s lesser security risk, since to receive/read the email and realise that the email doesn’t exist, any attackers must have access to the email account already.

Email when "email not found" on password reset?

Greetings, Is there any way to send an email to a user that is trying to reset his password, if the email he enters does not exist in the database? Right now, they do not know what email they need to use to reset their password. We understand and agree that showing an error '“email does not exist”, is bad practice, but this is a good alternative already implemented by multiple big sites like “humble bundle”. Regards Hd

[dan.woda]

Hi @jeff15,

Welcome to the Auth0 Community and thanks for the feature request!