When enabled,
Forgot Password
sends an email link instead of immediately changing the user's password and emailing temporary login credentials.
The user opens the link and chooses their own new password. The existing password remains unchanged until the reset is completed.
Password reset links:
  • Expire after 30 minutes.
  • Can only be used once.
  • Are replaced when another reset link is requested.
Password fields on the login and reset pages also include an option to show or hide the entered password. This is currently only available on the web login page, but will also be included in a future mobile app update.
This provides a more familiar password reset process, avoids requiring users to copy a temporary password from an email, and prevents an accidental reset request from immediately changing their existing password.