# Password recovery

**URL:** <https://www.ruby-forum.com/t/password-recovery/184005>\
**Category:** Rails\
**Created:** [February 23, 2010, 7:57pm UTC](https://www.ruby-forum.com/t/password-recovery/184005 "2010-02-23T19:57:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![craigrails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c2a13f/32.png) [@craigrails](https://www.ruby-forum.com/u/craigrails)\
**Post date:** [February 23, 2010, 7:57pm UTC](https://www.ruby-forum.com/t/password-recovery/184005/1 "2010-02-23T19:57:29Z")

</div>

Hi there,

I am looking to implement a password recovery feature so users on my  
site can request a password when they forget theirs…

My passwords are one way encrypted, using a sha1 hexdigest so  
currently users would only see a garbled string which is not their  
password.

So - are there any tutorials that cover this as a walkthrough, so I  
can learn as I go?  
I’ve tried google, but there’s so many suggestions, it’s knowing which  
is the best etc… Also couldn’t see anything that covered that on

> **[Ruby on Rails Screencasts - RailsCasts](http://railscasts.com)**
>
> Short Ruby on Rails screencasts containing tips, tricks and tutorials. Great for both novice and experienced web developers.

Any ideas?

Many Thanks

---

<div class="post-metadata">

**Author:** ![craigrails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c2a13f/32.png) [@craigrails](https://www.ruby-forum.com/u/craigrails)\
**Post date:** [February 23, 2010, 9:20pm UTC](https://www.ruby-forum.com/t/password-recovery/184005/2 "2010-02-23T21:20:23Z")

</div>

Craig W. wrote:

> My passwords are one way encrypted, using a sha1 hexdigest so  
> currently users would only see a garbled string which is not their  
> password.

First to get some semantics out of the way: SHA1 is not an encryption it  
is a message digest (a.k.a. hash). The whole point if message digest is  
that it cannot (within reason) be reversed.

You have two options:

1. Encrypt passwords using a encryption algorithm such as AES, DES, or  
Blowfish, so that you can reverse them. (NOT RECOMMENDED!).

2. Give the user temporary (one-time use) password and send them that.  
Keep track that the password is temporary and make them reset their  
password immediately after logging in. (This is the safest way I know of  
to implement password recovery).

The reason #1 is not recommended is that you must store the keys used to  
perform the encryption somewhere on your server. If your database was  
compromised then it’s highly likely that your server is compromised as  
well. A hacker would be able to find everything he needs to know to  
reverse all the passwords in the database. Secondly, as a developer you  
would also have the knowledge to reverse anyone’s password.

I personally get very upset if any web site is ever capable of telling  
me what my password is. I make every effort to avoid using sites that I  
know are capable of this.

---

<div class="post-metadata">

**Author:** ![craigrails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c2a13f/32.png) [@craigrails](https://www.ruby-forum.com/u/craigrails)\
**Post date:** [February 24, 2010, 12:04pm UTC](https://www.ruby-forum.com/t/password-recovery/184005/3 "2010-02-24T12:04:42Z")

</div>

> 1. Give the user temporary (one-time use) password and send them that.  
> Keep track that the password is temporary and make them reset their  
> password immediately after logging in. (This is the safest way I know of  
> to implement password recovery).

I would implement this slightly differently. Rather than create a  
temporary  
password, take them through the normal process and then enforce a  
password  
reset - I would create token, send them a link to a reset password page  
that  
has the token in the URL, accept a new password on that form, find a  
user  
with that token and change the password, remove the token from the user  
record (so it can’t be reclicked from email or hit accidentally) and  
redirect them (to either a login page or their profile page if you  
automatically log them in from the token).

To me that’s a slightly better UX flow than giving them a temporary  
password, login with it (knowing their browser may suggest to save the  
one-time password) and then ask them to reset it.

Cheers,

Andy

---

<div class="post-metadata">

**Author:** ![craigrails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c2a13f/32.png) [@craigrails](https://www.ruby-forum.com/u/craigrails)\
**Post date:** [February 24, 2010, 5:52pm UTC](https://www.ruby-forum.com/t/password-recovery/184005/4 "2010-02-24T17:52:40Z")

</div>

Andy J. wrote:

> I would implement this slightly differently. Rather than create a  
> temporary  
> password, take them through the normal process and then enforce a  
> password  
> reset - I would create token, send them a link to a reset password page  
> that  
> has the token in the URL, accept a new password on that form, find a  
> user  
> with that token and change the password, remove the token from the user  
> record (so it can’t be reclicked from email or hit accidentally) and  
> redirect them (to either a login page or their profile page if you  
> automatically log them in from the token).

Thanks, I like this better too. Should have thought of it myself. This  
would be easier for the user.

This is actually a third option too that I didn’t mention because it’s  
not quite ready for common use:

1. Eliminate username/password authentication from your site entirely.  
Then you don’t have to worry about password recovery at all (e.g.  
[http://stackoverflow.com](http://stackoverflow.com)).

This is the choice I made for my latest web site. However, I had the  
advantage that my users are software developers, as such I didn’t have  
any qualms about asking them to use OpenID. This was hugely advantageous  
for me as a developer. I know longer retain any responsibility of  
storing private data about my users. Not even passwords. Plus, doing  
this allowed me to forego SSL since there is no longer any private data  
passing across the internet to my site.

This is also becoming a viable option for any web site. Especially when  
combining OpenID with authentication using Twitter, Facebook, etc. So  
many big providers such as Google, Microsoft, Yahoo, AOL, WordPresss and  
others support OpenID these days. It’s getting to the point that almost  
everyone on “The Net” has at least one of these.

---

<div class="post-metadata">

**Author:** ![craigrails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c2a13f/32.png) [@craigrails](https://www.ruby-forum.com/u/craigrails)\
**Post date:** [November 19, 2013, 8:18am UTC](https://www.ruby-forum.com/t/password-recovery/184005/5 "2013-11-19T08:18:53Z")

</div>

You can even reset windows password while forgot it.  
The tool you need to handle it is a Windows Password Recovery software.  
The one ever helped me for Windows 8 Password recovery tool is this one:  
[http://windows8password.com/](http://windows8password.com/)  
It is simple to handle with powerful functions. Once you need to reset  
Windows Password, go ahead download one for trying. It is also  
compatible for Windows XP and Windows 7.