Password Reset Flowchart with Token Expiry

Mermaid code

flowchart TD
    A[User clicks Forgot password] --> B[Enter email address]
    B --> C{Account exists?}
    C -- No --> D[Show same success message]
    C -- Yes --> E[Create single-use token, 30 min expiry]
    E --> F[Email reset link with token]
    D --> Z[Done]
    F --> G[User opens link]
    G --> H{Token valid and unexpired?}
    H -- No --> I[Show expired link page] --> B
    H -- Yes --> J[Enter new password]
    J --> K{Meets password policy?}
    K -- No --> J
    K -- Yes --> L[Update hash, delete token]
    L --> M[Invalidate all active sessions]
    M --> N[Send confirmation email]
    N --> Z

Paste this into any tool that renders Mermaid, or into the editor to change the theme and export PNG or SVG. Syntax reference: Flowchart guide.

What this diagram shows

The flow starts at Forgot password and asks for an email. The Account exists? diamond has a deliberate quirk: both branches end in the same success message, so an attacker cannot enumerate accounts. On the Yes path a single-use token with a 30-minute expiry is created and emailed. When the link is opened, Token valid and unexpired? either sends the user back to the start or on to Enter new password, which loops until the policy check passes. The last three steps are the ones most often skipped: delete the token, invalidate every other session, and send a confirmation email so the real owner notices an unauthorized reset.

How to adapt it

• Change 30 min to your token lifetime and add the rate limit (max 3 requests per hour per email) to node E if you enforce one.
• Add a Require 2FA code? diamond before Enter new password for accounts with two-factor enabled.
• Split node D if you also want to log the attempt for monitoring without changing what the user sees.
• Replace the loop on K -- No --> J with a node listing your policy (12+ chars, not in breach list) if the rules are part of what you are documenting.

FAQ