When users forget their password they click on the reset password link. There, they enter their username, or password, and a mail goes to their inbox, instructing them on what to do.

The instructions say to follow a link that resets the password, and then redirects them to their user profile to enter a new password. Although they enter a new password, the next day (and everyday) the system doesn't recognize the password, and they have to reset it again.

Why does this happen?

How does the "reset password" work? Does it check the access date to see if the day has changed, or does it use some kind of flag to let the system know the password is valid only for one day?

  • 2
    Yes, similar issue here. What Drupal version you using? Modules related to authentication?
    – Caleb
    Commented Nov 14, 2012 at 15:19
  • @Caleb The problem for me had to do with the registration text sent with mail to users been registered. The text included three links. The first link was the login page. The second link was the reset link (when you forget your password and ask for a new one this is the page with this functionality). The problem was that the default text was asking the user to click the second link to login automatically thus making the user reset their password before even using it. Anyway if you have access to your database you can make tests by changing manually the registration time (unix timestamp).
    – tioschi
    Commented Nov 14, 2012 at 18:21
  • Would you mind reformatting that comment as an answer to this question? This could help future visitors with the same problem (mine is a little different, but I couldn't tell that except by seeing your solution).
    – Caleb
    Commented Nov 16, 2012 at 9:07
  • @Caleb i tried to explain more but i don't know if i made it clearer.
    – tioschi
    Commented Nov 16, 2012 at 10:08

1 Answer 1


Finally the problem in my case had to do with the text that was sent with mail after user registration. When user was registered a mail was sent in his inbox with his username and a (system created) password. Then the text was providing a link to the login page, a second one linking to the auto log in page (where the user supposedly would not have to enter his password) and a third one that it is irrelevant.

So i realized that the second link was actually a link to reset your password if you forget the old one. So the user when first reading the mail he click on the second link to log in automatically but he doesn't know that the password given to him was reseted and now his log in was valid only for one day or for one use. Each time he has to reset his password.

Anyway if you have access to your database you can experiment to see if it is another issue for you. You can create a fake account in drupal. In the mail that is sent to you click the second link (something like http://mysite.com/foo/user/reset/1085/1349294892/7bc9baf9d42aa774be00a0f36090323f). Then go to table 'user' of the drupal database, find the fake user you created and modify the record of the column 'created' and put a unix-timestamp older than a day (there are online unix-timestamp creator). This way you can experiment if the password is temporary or not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.