Password resets can be delivered by email or SMS, controlled by the Password Reset Method setting under Site Settings → Password Resets. Each has trade-offs around cost, security, and user experience.
The default and most common choice. Reset links arrive in the user's inbox; they click through to set a new password.
Advantages:
- Cheap. No per-message cost beyond whatever you already pay for outbound email.
- Familiar. Every user knows how a password-reset email works.
- Reliable. Modern email infrastructure (SPF, DKIM, DMARC) makes delivery near-perfect for legitimate senders.
- Works even when the user's phone is unavailable. Useful if they've lost or upgraded their phone.
Disadvantages:
- Vulnerable if email is compromised. An attacker who has access to the user's email can trigger and intercept password resets.
- Spam filters. Occasionally legitimate reset emails end up in junk folders. Test deliverability after every template change.
- Delivery delays. Most providers deliver near-instantly but occasional 5-10 minute delays happen, especially on first-send to a new recipient.
SMS
Reset links arrive via text message instead. The user receives a short message with a link or a code; they tap through (or enter the code) to set a new password.
Advantages:
- Separate channel from email. If email is compromised, SMS still works.
- Near-instant delivery. Typically arrives within seconds.
- Visible. Users notice SMS notifications more reliably than email.
Disadvantages:
- Per-message cost. SMS isn't free — pennies per message, but it adds up for popular apps.
- SIM-swap vulnerability. An attacker who can convince the user's phone carrier to port their number to a new SIM can intercept SMS. This is a real attack vector for high-value accounts.
- International availability. SMS delivery to some countries is unreliable or expensive.
- Requires a phone number on file. If your registration flow doesn't capture phone numbers, you can't use SMS reset.
Picking the method
For most apps, email is the right default. Three exceptions where SMS is worth considering:
Exception 1: Email is the credential being reset
If users log in with their email address, an attacker who compromises the email can trigger and intercept a reset. Using SMS as the reset channel breaks that link.
Exception 2: Field workers without reliable email
Some apps are used by field staff who don't routinely check email but always have their phone. SMS works better for that population.
Exception 3: High-value B2B accounts
For accounts with admin-level access to your platform, the extra friction and cost of SMS is justified by the higher security. Combine with TOTP-based 2FA for layered defence.
Time limit
Either way, the reset link expires after the configured Password Reset Time Limit (in minutes). Default is around 30 — short enough to limit replay risk if the email or SMS is intercepted, long enough that a user can find and click within a normal workflow.
For SMS specifically, you can usually go shorter (10 minutes) because SMS arrives near-instantly. Email can occasionally take longer to deliver so 30 is a safer minimum.
Tip: Consider supporting both. Some installs let the user pick between email and SMS at reset time, defaulting to whichever was used for their last login. That's the highest-flexibility option but requires custom code to implement — the platform's built-in setting picks one method globally.