How long do password reset links last?

There is no standard length. A password reset link lasts as long as the company that sent it decided, and the published defaults run from 10 minutes to 5 days. Among the identity services and software that send reset emails for other companies, 1 hour is the most common setting: Okta, Plesk and the Laravel web framework all default to it. Zendesk links last 24 hours, Django's last 3 days and Auth0's last 5 days. Microsoft's reset flow for Microsoft 365 administrators allowed only 10 minutes. The security guidance that developers follow, OWASP's Forgot Password Cheat Sheet, says a reset link must work once and expire "after an appropriate period", and gives no number. So if your link is more than an hour old, assume it may be dead and ask for a new one.

What the reset services actually set

Most sites do not build their own password reset. They use an identity service such as Okta or Auth0, a help desk platform such as Zendesk, or the reset feature of the web framework they are built on. The table gathers each one's documented default.

Why you hear both 1 hour and 24 hours

Search for this question and the answers are single products: a help page saying 24 hours, a forum post saying an hour. Each is right about its own product, and none is the general answer, because there is no rule behind them. NIST, the US standards body that sets limits for texted sign-in codes, publishes no equivalent figure for reset links, and OWASP deliberately leaves the number to the developer.

The two figures you see most are both real defaults. 24 hours was common for years, and Plesk's history shows the drift: in 2023 a Plesk staff member told a user on its forum that the link was limited to 24 hours "for security reasons", and from version 18.0.68, released in March 2025, it lasts 1 hour, also "due to security reasons". The same reasoning has moved in one direction. A reset link is a key to the account sitting in an inbox, and the shorter it lives, the less use it is to anyone who reads that inbox later.

Django keeps 3 days, and its documentation explains why a longer window is not the risk it sounds: shortening the timeout makes no difference to how easily a link can be guessed, because the tokens are designed to resist guessing without any timeout. The limit is about stale links lying around, not about someone working out the code.

Why only the newest link works

If you clicked "forgot password" three times and then opened the first email, it may say the link is invalid even though it is only a few minutes old. Many systems keep a single reset token per account, so a new request replaces the old one. Laravel's code does exactly this: before it creates a reset link for an address, it deletes any existing one.

Other systems are built differently. Django does not store the link at all; it calculates it from details of your account, including your current password and the time you last signed in. Every link it has sent stays valid until one is used or you sign in another way, and then all of them stop at once because those details have changed. Either way, the newest email is the safe one to open. OWASP requires that a link is invalidated once used, so an old reset email will fail after a successful reset.

Microsoft's admin reset flow, as its support article described it, added a condition that catches people out: the link had to be opened in the same browser session that started the request. Asking on a laptop and tapping the link on a phone failed, however quickly you did it.

What to do when a link has expired

An expired link cannot be revived, and it does no harm to leave it. Zendesk's own advice works everywhere: generate a new reset link from the sign-in page. Then:

1. Request once and wait. Emails can take a minute or two. On systems like Laravel's a second request makes the first email useless, and Laravel refuses one within 60 seconds by default.
2. Open the newest email only. Delete the older reset messages so you do not open the wrong one.
3. Use the same device and browser. Start the reset where you will finish it.
4. Check spam and the address you used. OWASP tells sites to show the same message whether or not an account exists, so "if an account exists, we have sent an email" does not confirm that one does. No email often means the account is under a different address.
5. Finish within the hour. Have the new password ready, ideally generated by a password manager that stores it for you, before you click.

If every reset email goes to an address you can no longer open, a fresh link will not help. That is a recovery problem, and the time to fix it is before it happens: setting up account recovery before you need it covers the backup address, phone number and codes that get you back in. An old address can also disappear from under you, since most free providers delete a mailbox after a long spell of no use, and the inactivity deadlines at the big email providers tell you how often to sign in.

A reset email you did not ask for

A reset email is easy to fake, and people expect to act on one quickly. A real one is triggered by a request; if you did not make one, do not click the link. Go to the site by typing its address or using its app. How phishing messages get past careful people covers what makes the fake ones convincing, and the red flags in scam emails lists the checks that still work.

A genuine but unexpected reset email usually means someone typed your address on the site, by mistake or on purpose. The link is no use to them, because it went to you. Leave it to expire. If you clicked a reset link in an email you now doubt and entered anything on the page that opened, what to do after clicking a phishing link takes you through the next steps in order.

The short expiry also protects a reset email sitting in an inbox someone else gets into later. That is why the inbox matters more than the link, and why locking down your email account is the step that protects every reset you will ever receive.

Where these numbers stop applying

Every figure in the table is a default, and every service except Microsoft's and Zendesk's documents a way to change it. A site built on Okta could give you 3 hours or 3 months; a site built on Django could have shortened its 3 days to 1 hour. Few banks, shops or social networks publish their figure.

The Microsoft figure comes from a support article for administrators of Microsoft 365, Intune and Azure that Microsoft has since retired, so it describes how that flow worked when the article was last published, not a current promise. It also does not cover personal Microsoft accounts.

Reset links are also different from the short codes some sites send instead. A six digit reset code sent by text or email follows the rules for one-time codes, which usually last 5 to 10 minutes, not the hours that links get.

These figures are taken from each provider's documentation as published in October 2026.

What to do with this

Treat a reset link as good for about an hour and for one use. Ask once, open only the newest email, finish on the same device, and ask again rather than fighting an old link. If you did not ask for it, leave it alone. Every reset you will ever do runs through your inbox, so the most useful ten minutes after this go on giving that inbox a second sign-in step and a recovery route that still works.