Chapter #42. Pre-fill the Username in "Forgot Password" Fields
If your user has tried to log in and failed, it's a safe bet that their next action will be to click "forgot password." Don't make them enter their email again—pre-fill the username field with the entry from their earlier login, so the user can just tap "reset password" and be on their way.
The forgot password flow of an app is—certainly from metrics I've seen—a very well-used feature. In fact, a user who uses a difficult password, forgets it, then resets it every time, is probably more secure than a user who just uses a weak password. So, let's make the forgot password field easy by following these rules:
If the user gets their password wrong, pre-fill the username field with the last-used username (or email) and show a "forgot password" button
When they hit the button, email (or SMS) them a link that expires within a sensible time period
The link, when tapped, should open a page for them to type a new password
If the link is used...