Hacksplaining
FeaturesLessonsEnterpriseThe BookOWASP Top 10PCI Compliance
Sign Up
Log In
FeaturesLessonsEnterpriseThe BookOWASP Top 10PCI Compliance Sign Up Log In

User Enumeration

If your password reset process involves sending an email, have the user enter their email address. Then send an email with a password reset link if the account exists - and a sign-up email if it's a new email address.

A password reset page leaking user information
Lessons
Glossary
Terms and Conditions
Privacy Policy

© 2026 Hacksplaining Inc. All rights reserved. Questions? Email us at support@hacksplaining.com