The accounts you need
| Account | What happens to it | What it checks |
|---|---|---|
| Old and new address | The account’s email changes from one to the other | A confirmation to the new address, a warning to the old one, and sign-in with the new email only once it’s confirmed |
| Locked out | Too many wrong passwords | The lockout, the unlock or reset email, and that the lock lifts when it should |
| Repeated reset | Asks for a password reset twice | Only the newest link works, and the old one fails with a clear message |
| Two-step | Turns on email codes | Codes arrive, expire, and can’t be used twice |
| Deleted | Deletes their account | The confirmation step, the “account deleted” email, and what happens when the same email signs up again |
Set them up
- Create the set in one go: choose Add account, set How many to six (two for the email change), label the batch “Account changes” and tick Generate persona.
- Sign up as each and save its password on the address. After a password change or reset, replace the saved password on the address so it stays right.
- Write what you did in the notes as you go, for example “Email changed to x7aa… on 13 Oct · old address should get no more mail”.
What to check
- Change of email: the account keeps the old email until the new one is confirmed, the old address gets a notice with a way to undo it, and the confirmation link works once.
- Password reset: older links stop working, a reset signs out other sessions if your app says it will, and a “password changed” email follows.
- Lockout: the message doesn’t reveal whether an email has an account, the unlock email arrives, and the counter resets after a good sign-in.
- Two-step codes: they expire, can’t be reused, and too many wrong codes are stopped. A new-device email arrives if you send one.
- Deletion: there’s a confirmation step, the data is really gone, and signing up again with the same email starts fresh, or is held back if your rules say so.
The emails to check
Each of these flows sends at least one security email. It should come from a name people recognise, say what happened and when, and offer a way out if it wasn’t them. Read each one in the inbox: links become one button named for what they do, and codes get a Copy button and a countdown. For resets in more depth, see Test password reset emails.
Use these accounts only on apps you build or are allowed to test, in development, staging or QA.