> ## Content Index > Fetch the complete content index at: https://securinglaravel.com/llms.txt > Use this file to discover other available public pages before exploring further. # Security Tip: Password Resets and MFA? - URL: https://securinglaravel.com/security-tip-password-resets-and-mfa/ - Published: 2025-08-22T08:25:45.000Z - Updated: 2025-08-22T08:25:45.000Z - Description: [Tip #120] How should we safely handle resetting forgotten passwords without compromising the protection that MFA provides? - Author: Stephen Rees-Carter - Tags: Security Tips, MFA, Authentication, Passwords So far in our series on [MFA](https://securinglaravel.com/tag/mfa/), we've covered [Setting up 2FA](https://securinglaravel.com/in-depth-setting-up-two-factor-authentication/), [using 2FA for more than just logins](https://securinglaravel.com/security-tip-2fa-isnt-just-for-logins/), and [Account Recovery for forgotten MFA](https://securinglaravel.com/security-tip-account-recovery-for-mfa/), but there is one rather large piece that I ~~forgot to cover~~ left until now... **Resetting Forgotten Passwords when MFA is enabled!** The scenario is a simple one: The user has MFA enabled on their account, and still has access to their TOTP app, but they've forgotten their password! There are two ways you could go about solving this: 1. Let the user reset their password through the standard email verification flow. Once they change their password, **do not log them in automatically**, instead require them to complete a full login, and verify their MFA. *(Don't forget to revoke all remember tokens too!)* 1. The worst case here is that an attacker can hijack the user's email account and change their password, but they cannot breach the account as they don't have the MFA token. 2. Require MFA verification during the password reset workflow, in addition to email verification. Only allow the password change when the user has been fully authenticated. Either option works, so pick the one that works best for you. **Important Note: When the user has multiple authentication factors, do not allow a single factor to disable or bypass the user's other authentication factors.** I.e. Don't allow OTPs to reset passwords without also verifying their email address too, and conversely don't reset OTPs with just an email verification bounce. 💡 **This is one of the reasons SMS MFA gets such a bad name: many apps were using SMS as both MFA and a single Account Recovery method, bypassing email verification, and a juicy target for attackers.* Oh, and don't bother with Security Questions. They are either easily guessable/phish-able (i.e. first pet, mothers maiden name, etc), or something you need to remember - like Recovery Codes - that you'll forget in a week. ## Protect your code, protect your business. Sign up for [****weekly Laravel Security tips**](https://securinglaravel.com/tag/tips/) and [****monthly In Depth articles**](https://securinglaravel.com/tag/in-depth/) full of indispensable security advice to keep your Laravel applications safe. Subscribe Email sent! Check your inbox to complete your signup. No spam. Unsubscribe anytime. --- ***If you found this security tip useful?* 👍** [*Subscribe now*](#/portal/signup) *to get weekly* [***Security Tips***](https://securinglaravel.com/tag/tips/) *straight to your inbox, filled with practical, actionable advice to help you build safer apps.* ***Want to learn more?* 🤓** *Upgrade to a* [*Premium Subscription*](#/portal/signup) *for exclusive monthly* [**In Depth* articles*](https://securinglaravel.com/tag/in-depth/)*, or support my work with a* [*one-off tip*](#/portal/support) *or* [*recurring Sponsorship*](https://securinglaravel.com/sponsor/)*! Your support directly funds my security work in the Laravel community.* 🥰 **Need a second set of eyes on your code?** *Book in a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com) *today! I also offer budget-friendly* [*Security Reviews*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com) *too.* *Finally, connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*