One-Time PHP Password Reset Links with Expiration

A password reset link is a temporary credential. Anyone who obtains it may be able to change the account password, so the token must be difficult to guess, short-lived and invalid after successful use.

Create and store a verifier

Generate a token with a cryptographically secure random source such as PHP's random_bytes(). Send the raw token only to the verified recovery address over HTTPS. Store a hash or verifier in the database with the account, creation time and expiration; never store the raw token as a reusable database credential.

Use a URL that cannot be confused with another account or environment. Avoid putting the token in application logs, analytics events or referrer-bearing third-party pages. The reset page should not load external resources that could receive the full URL.

Consume it once

On submission, validate the token and expiry, apply password policy, update the password hash and invalidate the reset record in one transaction where practical. Protect the form against cross-site request forgery and rate-limit requests. If the token is expired or used, issue a fresh reset flow rather than silently accepting it again.

Do not disclose whether an account exists

Use a consistent public response for known and unknown email addresses, and avoid large timing differences that reveal the result. Limit how often messages can be sent and make the email explain what to do if the user did not request a reset.

After a successful reset, consider revoking active sessions and other recovery tokens according to the application's policy. Test expired, malformed, reused and valid links. Reset functionality should be reviewed like a login feature because it can become the easier route into the account.