A password-reset workflow is the recovery path that lets a legitimate user regain account access after forgetting a password. Typical steps include proving control of a registered email address, answering a recovery challenge, using a one-time token, and then setting a new password. The goal is to restore access without weakening the account’s security posture.
In cyber security, this flow matters because it often sits close to primary authentication but receives less scrutiny than login. If an attacker can bypass a verification step, the reset path can become an account-takeover route: the attacker changes the password without proving ownership of the account. Defenders treat reset flows as high-value targets, harden token validation, limit reset attempts, monitor for unusual reset activity, and test for logic flaws that let state checks be skipped. A secure recovery workflow should fail closed, require strong proof of control, and never trust user input alone.