Password reset email template
Help someone back in with an expiring reset link, the request details, the link spelled out, and what stays signed in. Edit it in the AI email editor.
Customize copy and variables in the AI email editor. Browse all email templates or the Transactional collection. See the Welcome email template.
See the email before you edit.
Subject
Reset your Plinth password
Preheader
Choose a new password for maya@halyard.example. The link works once, for 30 minutes after this email was sent.
Make it fit the send.
- Generate a short-lived, single-use reset URL in your application. The template displays the URL, expiry notice, and a fallback the recipient can paste. Your application enforces expiry and single use.
- Pass the request details as a list of label and value so the recipient can tell their own request from someone else's. The session summary says what a new password leaves signed in, for example “2 browser sessions and 3 CLI tokens”.
- Offer the passkey prompt only to accounts that can use one. The default fixture omits it and the reset action stands alone; long-content includes it.
- It is written for Plinth, a fictional platform for deploying web apps. Replace its mark and the key pictogram with your own, and restyle through the theme tokens in starter.css.
Data this template expects.
- {{account}}
- The address whose password is being reset, for example maya@halyard.example. Shown in the body.
- {{expiryNotice}}
- For example: “The link works once, for 30 minutes after this email was sent.” Match your server’s token lifetime and reuse policy; this text does not enforce either.
- {{passkeyPrompt}}
- Optional object with label, detail, and url strings. Omit it when your product does not support passkey enrollment.
- {{requestDetails}}
- A list of { label, value } objects, for example { "label": "Device", "value": "Chrome 141 on Windows 11" }. Include only context your application actually recorded.
- {{resetUrl}}
- The complete HTTPS reset URL issued by your auth system. Both the button and the visible fallback use this same value. Preview: https://plinth.example/reset/7d1a83c9.
- {{securityUrl}}
- Your account-security page. Require the appropriate authentication before displaying account activity.
- {{sessionSummary}}
- What a new password leaves signed in, phrased to follow “doesn't sign out your”, for example “2 browser sessions and 3 CLI tokens”. Make it match what your product does after a reset.
- {{supportEmail}}
- A monitored help address, for example support@plinth.example. Never ask recipients to forward a live reset link.
Choose the Reset Variant
Password recovery: keep one “Choose a new password” action and the same URL as a text fallback. The default fixture omits passkeyPrompt so the recipient can finish the task without a second offer.
Passkey enrollment: add passkeyPrompt only when enrollment exists in your product. Make it an optional next step after recovery; its URL must lead to your own authenticated enrollment flow.
Plain-text delivery: include the product name, reset URL, expiration, and support address in your text body. Do not replace the link with a new password, and do not add promotional content to a recovery email.
Handle Expired and Unrequested Resets
An expiration sentence does not invalidate a token. Your application must reject expired or already-used tokens and offer a route to request another email. Set expiryNotice from that same configured policy; the preview’s 30 minutes is example data, not a recommended default.
For a request the recipient did not make, the email says their password has not changed. Keep the security and support destinations useful without requiring them to open or forward the reset link. Do not claim that an unsolicited request proves the account was compromised.
The email promises that a new password does not end other sessions unless the reader chooses to. If your product revokes sessions on reset, change that sentence in the source. Before sending, test an expired link, a reused link, and a second reset request, and decide whether a newer request revokes the older token.
Connect the Template to Authentication
Use your auth provider’s password-reset callback as the source of the recipient and resetUrl. Your application generates and validates tokens, limits requests, and changes the password. Samva renders and delivers the email.
The Better Auth integration documents the sendResetPassword callback and template overrides. Its default email is separate from this gallery template: customize this starter in the editor, then wire your rendered HTML and text into the callback’s template override. Do not assume the gallery slug selects an integration template.
Example copy
Example. This is the gallery preview for Plinth, a fictional platform for deploying web apps. The 30-minute sentence is sample data. Your application issues the reset URL and decides when it stops working.
- Subject
- Reset your Plinth password
- Preheader
- Choose a new password for maya@halyard.example. The link works once, for 30 minutes after this email was sent.
Someone asked to reset the password for maya@halyard.example. If it was you, choose a new one. The link works once, for 30 minutes after this email was sent.
Choose a new password: https://plinth.example/reset/7d1a83c9
What stays signed in. A new password doesn't sign out your 2 browser sessions and 3 CLI tokens. After the reset, Plinth asks whether to sign them out and revoke the tokens, and does nothing unless you choose to.
The request. Device: Chrome 141 on Windows 11. Place: Austin, Texas, US. Time: 18 October 2026, 07:26 CDT.
Didn't ask for this? Your password hasn't changed and nobody can change it without this link. Ignore the email, or review recent sign-ins.
Button not working? Paste this link into your browser: https://plinth.example/reset/7d1a83c9
Questions go to support@plinth.example.
Common questions.
What should a password reset email say?
Name the product, say that someone asked to reset the password, and give one link the recipient can paste. The example above uses the subject “Reset your Plinth password” and tells the reader the link works once, for 30 minutes after the email was sent. That sentence is copy. Your application issues the URL and rejects it when it expires or has already been used. Samva renders the template and sends the email.
Is this a “your password has been reset” confirmation email?
This template sends a reset link after someone requests a password change. Send a separate confirmation only after your application successfully changes the password. That email should confirm the change, explain what happened to existing sessions, and give a support or account-security link. It should not reuse the reset link.
Does this template expire the reset link?
No. The expiry sentence is the expiryNotice you pass in. The preview’s 30 minutes is example data, not a timer Samva enforces. Your server rejects an expired or already-used token and offers a way to request another email.
Can I change the password reset copy without a deploy?
Yes. Open the template in the AI email editor, change the copy, and send the rendered HTML and text from your auth callback. The Better Auth default email is separate from this gallery template: wire that rendered output into the callback’s template override.