If a user forgets her password, she can request a new one which will be sent as plain text by mail. Is there a way (extension for example) to not send the password directly, but a password recovery link which is only valid for a certain amount of time?


  • What version are you using? This is a default behavior on the latest versions
    – Marius
    Commented Jul 1, 2014 at 6:33
  • I am using 1.4 which does not support that feature I think. Commented Jul 1, 2014 at 6:35
  • 1
    I think you should upgrade. To 1.8 at least. And it will solve your problem...and many more.
    – Marius
    Commented Jul 1, 2014 at 6:55
  • Yeah, but I cant :), I have to solve it with the version I currently have. Commented Jul 1, 2014 at 6:58
  • 3
    Then get the 1.8 or 1.9 version, and see if you can extract the password recovery system from there.
    – Marius
    Commented Jul 1, 2014 at 7:02

1 Answer 1


You have a ton of bugs and security issues with your version. There is "no alternative" to upgrade! This said, check out the code of Magento 1.9 for the sendPasswordForgottenEmail.

It starts here:


generates a password reset token:

$newResetPasswordLinkToken = Mage::helper('customer')->generateResetPasswordLinkToken();

sends an email with this token app/locale/en_US/template/email/account_password_reset_confirmation.html

If you click on it, the token is checked \Mage_Customer_AccountController::resetPasswordAction, then you can reset your password: app/code/core/Mage/Customer/controllers/AccountController.php:591

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.