How do I test password reset?
Last checked 31 Aug 2026
Short answer
Request a reset with a real account, confirm the email arrives with a working link, complete the reset, and confirm the old password stops working and the reset link can't be reused.
Steps to test
- Trigger "forgot password" from the real login screen using a genuine test account.
- Check the email arrives promptly, isn't in spam, and the link points to your actual domain (not a broken redirect).
- Follow the link and set a new password — confirm the new password rule validation matches sign-up (length, complexity if configured).
- Log in with the new password — confirm it works.
- Try the old password — it should be rejected.
- Try reusing the same reset link a second time — it should be expired/invalid, not usable again.
- Let a reset link sit unused past its expiry window and confirm it correctly stops working (Supabase auth links typically expire; check the time window with Lovable if unsure).
A prompt if it's not working
The password reset email isn't arriving / the reset link errors out — check the auth email settings and the redirect URL configuration for password reset.
What usually goes wrong
- Reset emails not configured with a proper "from" address or redirect URL, so links point to
localhostor the wrong domain after publishing — always retest this after moving to a custom domain. - Reset links that don't expire or can be reused, which is a real security gap.
- No rate limiting on reset requests, letting someone spam a user's inbox.
- Confusing "password reset" (forgotten password) with "change password" (logged-in user) — test both if you offer both.
Was this answer helpful?
Related questions
- AnswerHow do I test forms?Submit every form with valid, invalid and empty data, confirm error messages appear, and check that submitted data actually lands where it should (database, inbox or integration).
- AnswerHow do I test mobile devices?Open the published site on a real phone (or use your browser's device toolbar as a fallback) and check layout, tap targets, forms and navigation at common breakpoints.
- AnswerHow do I test RLS?Try reading and writing data as a different logged-in user and as a logged-out visitor to confirm row-level security actually blocks what it should, rather than assuming the policy is correct.
- AnswerHow do I test SEO?Check that every page has a unique title and meta description, images have alt text, the site generates a sitemap, and preview the page as a search engine or social share would see it.
