# Acts\_as\_authenticated reset vs. resend password

**URL:** <https://www.ruby-forum.com/t/acts-as-authenticated-reset-vs-resend-password/117446>\
**Category:** Rails\
**Created:** [October 17, 2007, 12:23am UTC](https://www.ruby-forum.com/t/acts-as-authenticated-reset-vs-resend-password/117446 "2007-10-17T00:23:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jgjgjg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/22d042/32.png) [@jgjgjg](https://www.ruby-forum.com/u/jgjgjg)\
**Post date:** [October 17, 2007, 12:23am UTC](https://www.ruby-forum.com/t/acts-as-authenticated-reset-vs-resend-password/117446/1 "2007-10-17T00:23:35Z")

</div>

We’re using acts\_as\_authenticated and we’d like to just send users  
their forgotten password instead of resetting it. I read that this can  
be somewhat risky since you have to decrypt the password to send it.  
Does anyone have any thoughts on the risk of doing this and if there  
is a better solution?

Thanks

Jason

---

<div class="post-metadata">

**Author:** ![jgjgjg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/22d042/32.png) [@jgjgjg](https://www.ruby-forum.com/u/jgjgjg)\
**Post date:** [October 17, 2007, 1:58am UTC](https://www.ruby-forum.com/t/acts-as-authenticated-reset-vs-resend-password/117446/2 "2007-10-17T01:58:15Z")

</div>

You cannot decrypt it. It’s a one-way hash. (\*)

I would recommend doing something like this:

Make an action that will set a password change code string, using the  
same methods that the activation code uses. This is a long,  
unpredictable string to an attacker. This page will say something  
like “Your password has been reset. Please check your email, and  
follow the directions within it.”

You then mail them a URL which uses this code, say  
[http://example.com/account/lost\_password/1231d1ljkh1299u31n39d3d2092b2d](http://example.com/account/lost_password/1231d1ljkh1299u31n39d3d2092b2d)  
(the latter part is their unique reset code.) This action will ask  
for their login name, a new password, and the verification of that  
password. If everything matches, you reset their password (and be  
nice and mail them that it was reset.)

This way you never store the clear-text version of their password, and  
they can continue to do bad things like use the same password for  
their banking accounts. 🙂

(\*) OK, so you COULD brute-force it, or do some sort of dictionary  
attack on it. But why would you want to do this? Storing the hashed  
password means that if your database is exposed people cannot just use  
the passwords in it to log into any account.