That’s why I keep the harder-to-guess secret in the browser where the code request was initiated. If somebody read the code from your “postcard” and tried to en

That’s why I keep the harder-to-guess secret in the browser where the code request was initiated. If somebody read the code from your “postcard” and tried to enter it, they’d see an error and have to start over. Problem I have with most password reset schemes is they put the secret token in a URL, which is visible to all by the postcard analogy.