A broken password reset is a support ticket factory.

Password reset failures cluster into categories:

Email not delivered:

The most common cause. Using SMTP or an unconfigured email service without SPF/DKIM results in emails landing in spam or being rejected. Check spam folder first. If consistently failing: migrate to a proper transactional email provider (Resend, SendGrid) with domain authentication.

Token expired before use:

Reset tokens should expire. 1 hour is the standard window. If they're expiring in minutes, the expiry calculation has a bug. If they're expiring before the email is even received, there's a delivery latency issue.

Token reuse not prevented:

Reset tokens should be single-use. After the password is reset, invalidate the token. If the token remains valid after use, anyone who accesses the email later could still use the link.

Wrong URL in email:

Hardcoded localhost:3000 URLs in the reset email link (production email still pointing to development URL). Fix: set NEXT_PUBLIC_BASE_URL environment variable and use it when generating the reset link.

The correct implementation:

// Generate reset token
const token = crypto.randomBytes(32).toString('hex');
const hashedToken = crypto.createHash('sha256').update(token).digest('hex');

// Store in DB
await db.update(users).set({
  passwordResetToken: hashedToken,
  passwordResetExpires: new Date(Date.now() + 60 * 60 * 1000) // 1 hour
}).where(eq(users.email, email));

// Send email with raw token (not the hash)
const resetUrl = `${process.env.NEXT_PUBLIC_BASE_URL}/reset-password?token=${token}`;

When verifying: hash the submitted token, compare to the stored hash.