Back to Business ModeEmail
Account Recovery
Recovery has to be usable by someone who's locked out, while being unusable by an attacker pretending to be locked out.
CAPTCHA on the recovery form filters out scripted mass-recovery abuse
Rate limiting stops an attacker from spamming reset emails to harass a user
Changing a password while logged in still requires the current password
A successful reset logs out every other active session, everywhere
Hands-on demo
Account Recovery
Try it yourself
Try it yourself — run a scenario below, then flip this and replay it to see what changes.
Forgot Password Flow
From "I forgot my password" to a fully rotated set of sessions.
Want this flow explained in detail as it plays?
app.flowground.dev/forgot-password
Forgot password?
Selected hop
User requests a password reset
User
The person using the app.
App
The application's backend — enforces business rules and decides what every request is allowed to do.
What happens here
Enters [email protected] on the "Forgot password" screen.