What's wrong with sending the user a JWT[0] with a short expiration time as their password reset token? For example, { "account_id": 12345678, "password_re

What's wrong with sending the user a JWT[0] with a short expiration time as their password reset token? For example, { "account_id": 12345678, "password_reset_token": "bohghai6fui1Ma7ozaF3nu2PheV2eeroh8daonoh6ceiCub3joengei2Lohhu8ti", "exp": 1474737955 } Set the expiration to be 5 minutes from the time the token is generated. This leaves open the possibility that the same token could be used to reset the user's password multiple times, but you could avoid that by including the hash of the user's previous password in the token, or by keeping a "password changes" counter in the database and including that value in the token. 0: https://tools.ietf.org/html/rfc7519#page-9 https://tools.ietf.org/html/rfc7519#page-9 or https://jwt.io https://jwt.io