Test password reset emails without a real inbox
Give every project a private, permanent test inbox, trigger a reset from staging, and check the sender, link, and expiry before a real customer ever sees the email.
Free plan includes 500 emails a month. No credit card.
- 1SenderMatches your brand and a monitored address
- 2SubjectClear, and free of personal data
- 3Reset linkOpens the right environment, not production
- 4ExpiryStated, short, and enforced
Why password reset emails are hard to test
A reset email carries a live link to an account, so where it lands matters. The common shortcuts all have a catch.
Your personal inbox
Test resets pile up next to real mail, and a live reset link sitting in a personal inbox is a security risk of its own.
Gmail plus addresses
Aliases like you+test@gmail.com still land in one shared mailbox, so tests collide and nobody else on the team can see the email.
Temp-mail sites
Public inboxes expire halfway through a test, and anyone who guesses the address can read your reset link.
How to test a password reset email in four steps
The same flow works in local development, staging, and QA.
- 01
Create a private test inbox
Add a project and an inbox in Inceptmail, for example reset.acme@inceptmail.dev. The address is ready instantly and never expires.
- 02
Create a test account with that address
Sign up in your staging app using the inbox address, so the account belongs to an email you control.
- 03
Request a password reset
Use your Forgot password flow. The reset email appears in your inbox as it arrives, with no refreshing.
- 04
Inspect the email and follow the link
Check the details below, then click the reset link and confirm you can set a new password and sign in.
What to check in every password reset email
Arrival is the easy part. These are the details that break in real products.
Sender and reply-to
The from name and address match your brand and a real, monitored address, not a default from your mail provider.
Subject line
It is clear and specific, such as Reset your password, and includes no password or personal data.
Reset link destination
The link points at the right environment. A staging email that links to production is the most common bug.
Token and expiry
The link works once, expires in a reasonable time (commonly 15 to 60 minutes), and an older link stops working after a new request.
HTML and markup
The email renders correctly and the markup is clean. Use the Preview and Raw HTML tabs to check both.
No account leakage
Requesting a reset for an unknown address should not reveal whether an account exists.
Common password reset email bugs
If you see one of these, the flow is not ready to ship.
| Bug | What you will notice |
|---|---|
| Link points to production | Clicking a staging reset link opens the live site. |
| Token already expired | The link says invalid or expired the moment you click it. |
| Old links still work | Requesting a second reset does not invalidate the first email. |
| Email sent twice | Two identical emails arrive for a single request. |
| Broken HTML | Buttons or images are missing, or the layout collapses on mobile. |
| Wrong recipient | The email goes to a different address than the one entered. |
Test password reset emails with Inceptmail
A private test inbox for every project, built for checking exactly what your app sent.
Private and permanent
Each inbox belongs to your account and its address never expires, so the same address works in every test run.
Live delivery
Reset emails show up the moment they are sent, so you are never refreshing and waiting.
Preview and raw HTML
See the rendered email and the underlying markup, and open any attachments.
Shared with your team
Give QA teammates access to just the inbox they need, without sharing a mailbox.
See how the address works in how it works or compare plans and pricing.
Password reset email testing FAQ
How do I test password reset emails in staging?
Create a private test inbox, sign up in staging with that address, trigger Forgot password, and inspect the email that arrives. Check the sender, the link's destination, the token, and the expiry, then follow the link to confirm the whole flow works.
Can I use a temp mail address to test password resets?
You can, but public temp-mail inboxes are readable by anyone who guesses the address and often expire before you finish testing. A private, permanent inbox is safer and repeatable.
Is Gmail plus addressing good enough for testing?
It works for a quick check, but every test email lands in one shared mailbox, mixes with real mail, and your teammates cannot see it. A dedicated test inbox per project keeps tests separate and shareable.
How long should a password reset link last?
Most products use a short window, commonly between 15 minutes and an hour, and make the link single use. Test that an expired or already used link fails safely and that requesting a new reset invalidates the old one.
Should a reset email reveal whether an account exists?
No. The response to a reset request should look the same whether or not the address has an account, so attackers cannot use it to discover users. Test with an unregistered address and confirm nothing gives the difference away.
Do I need to change my code to test with Inceptmail?
No. You only use the inbox address as the account email in your test environment. Nothing about how your app sends email changes.
Is Inceptmail free for password reset testing?
Yes. The Free plan includes 500 emails a month, 3 inboxes per project, and 7 days of message history, with no credit card needed.
Give your test email a proper home.
Create your first inbox in under a minute. The Free plan covers a whole project.
Get started free