If a user forgets her password, she can request a new one which will be sent as plain text by mail. Is there a way (extension for example) to not send the password directly, but a password recovery link which is only valid for a certain amount of time?


  • What version are you using? This is a default behavior on the latest versions
    – Marius
    Jul 1, 2014 at 6:33
  • I am using 1.4 which does not support that feature I think. Jul 1, 2014 at 6:35
  • 1
    I think you should upgrade. To 1.8 at least. And it will solve your problem...and many more.
    – Marius
    Jul 1, 2014 at 6:55
  • Yeah, but I cant :), I have to solve it with the version I currently have. Jul 1, 2014 at 6:58
  • 3
    Then get the 1.8 or 1.9 version, and see if you can extract the password recovery system from there.
    – Marius
    Jul 1, 2014 at 7:02

1 Answer 1


You have a ton of bugs and security issues with your version. There is "no alternative" to upgrade! This said, check out the code of Magento 1.9 for the sendPasswordForgottenEmail.

It starts here:


generates a password reset token:

$newResetPasswordLinkToken = Mage::helper('customer')->generateResetPasswordLinkToken();

sends an email with this token app/locale/en_US/template/email/account_password_reset_confirmation.html

If you click on it, the token is checked \Mage_Customer_AccountController::resetPasswordAction, then you can reset your password: app/code/core/Mage/Customer/controllers/AccountController.php:591

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.