Magento 2 forgot password doesn't check email exist or not. It gives the message

If there is an account associated with [email protected] you will receive an email with a link to reset your password.

It should give an error message if email not exist.

  • did you ever find a solution to this?
    – Devidas
    Jan 28, 2020 at 10:11

1 Answer 1


That would be security risk as any one can check if some user have account on the website or not . Then he just have to guess a password . So message should be always success .

If you want to change it , you can modify the logic in magento/module-customer/Model/AccountManagement.phpin initiatePasswordReset method where customer is loaded . you can check if customer exists and throw error like

                    __('The email address is does not exist. Verify the email address and try again.')

But i would strongly suggest not to change this logic as that would be security flaw

  • You are right, that would be a security risk. Jul 25, 2019 at 9:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.