--- title: "Test password reset emails end to end · Proxy Mail QA" description: "Test forgot-password flows end to end: get the reset link instantly, check expiry and reuse, and keep the new test password saved with the account." url: https://proxymail.qa/solve/password-reset-testing --- 1. [Home](https://proxymail.qa/) 2. [What we solve](https://proxymail.qa/solve) # Test password reset emails end to end To test a password reset you need an account whose inbox you control, the reset email, and somewhere to remember the new password. Proxy Mail QA keeps all three on one row. Updated 11 October 2026 ## Why reset flows get skipped - **You need a real, reachable inbox.** Accounts created with made-up addresses can never receive a reset email. - **Passwords get lost.** After a few resets, nobody remembers which password the test account has now. - **The edge cases matter most.** Expired links, reused links and resets for addresses that don’t exist are where security bugs live. ## How Proxy Mail QA helps 1. Create an address, sign up with it, and save the password on the address: click its row to open its details, where **Generate a test password** makes one. 2. Use **Forgot password** in your app. The row shows a **Reset password** button as soon as the email arrives. 3. Set a new password, then update the saved one so the next tester knows it. 4. Add a note such as “reset twice, MFA off”, so the history of the account travels with it. ## What to check in a password reset email - The email arrives for a registered address, and the app’s response doesn’t reveal whether an address is registered. - The link expires after the stated time, and works only once. - Requesting a second reset makes the first link stop working. - The reset page enforces the same password rules as sign-up. - Other sessions are signed out after the reset, if that is your policy, and a “your password was changed” email follows. - The link opens your real site, not `localhost` ([here’s why that happens](https://proxymail.qa/solve/localhost-links)). ## Automating this? Make it a test: waitForLink with type reset returns the reset link, and setPassword keeps the saved password in step after your test changes it. [Node.js client](https://proxymail.qa/docs/node) [Python](https://proxymail.qa/docs/python) [Set up your coding agent](https://proxymail.qa/docs/api#agent-setup) ## Try it on your next sign-up test Free plan, no credit card. Create an address and watch the code or link arrive. [Create a free account](https://app.proxymail.qa/?mode=signup&from=site-solve-password-reset-testing) ## Questions ### Where do I keep the passwords for test accounts? Next to the address. Saved test passwords are encrypted with a key that never enters the database, hidden until you reveal or copy them, and every reveal is logged. They're deleted with the address. ### Can I generate a strong password for the sign-up form? Yes. Generate a test password creates a 16-character password with every character class, which passes common sign-up rules. ### What happens to the account when the address expires? The address, its mail and its saved password are deleted, and the name is never issued again. The account in the app you tested stays, but nobody can receive its reset emails. ## Related guides - [Test sign-up and email verificationA fresh, private address for every sign-up test, with the verification link or code ready the moment it lands.](https://proxymail.qa/solve/email-verification-testing) - [Test OTP and one-time login codesCodes pulled out of the email with a Copy button and a countdown when the email says how long they last.](https://proxymail.qa/solve/otp-code-testing) - [Test magic links and passwordless sign-inSingle-use links that are never opened or prefetched on our side, so they still work when you click them.](https://proxymail.qa/solve/magic-link-testing) - [Stop sharing one Gmail inbox for QAPrivate, disposable addresses for every tester instead of one shared mailbox and a pile of plus-addresses.](https://proxymail.qa/solve/shared-test-inbox) - [Take QA notes by voice with Wispr FlowDictate what each test account is for, its state and what you found, straight into its notes, in seconds.](https://proxymail.qa/solve/voice-notes-wispr-flow) - [Verification link points to localhost:3000Why emails from staging link to localhost, how to fix it in Supabase, Firebase and other stacks, and how we flag it.](https://proxymail.qa/solve/localhost-links) - [Common Supabase sign-up and login problemsEmails that never arrive, links that expire or sign nobody in, and sign-ups that fail, with the fix for each.](https://proxymail.qa/solve/supabase-auth-problems) - [Common Firebase sign-up and login problemsMissing verification and reset emails, verified users who still look unverified, failing links and sign-up limits, with the fix for each.](https://proxymail.qa/solve/firebase-auth-problems) - [Sign-up and login problems in vibe-coded appsThe login bugs AI-built apps usually ship with: emails only you receive, links to the preview, missing pages, and what to ask the builder.](https://proxymail.qa/solve/vibe-coded-login-problems) - [Test sign-up emails in PlaywrightA complete Playwright test for sign-up codes and links, from a fresh inbox to the report on the pull request.](https://proxymail.qa/solve/playwright-email-tests) - [Test sign-up emails in CypressA complete Cypress test for sign-up links and codes, with the email waits running as Cypress tasks.](https://proxymail.qa/solve/cypress-email-tests) - [Test sign-up emails with pytestA complete pytest test for sign-up codes and links, with Playwright for Python or Selenium and a one-file helper.](https://proxymail.qa/solve/pytest-email-tests) - [Test coupon codes and welcome offersThe coupon with its discount, end date and arrival time, what checkout did with it, and a failure when an expired or reused one is accepted.](https://proxymail.qa/solve/coupon-code-testing) - [Test unsubscribe links and one-click unsubscribeThe unsubscribe headers and link checked on every marketing email, and a watch that flags any marketing after unsubscribing, with no time limit.](https://proxymail.qa/solve/unsubscribe-testing) - [Test that a welcome offer can't be claimed twiceVersions of one address that reach the same inbox, and a check that fails when the same person got the offer more than once.](https://proxymail.qa/solve/welcome-offer-abuse) [Built your app with an AI tool? Pick yours](https://proxymail.qa/built-with)