# Always allow username-based password reset
**URL:** https://meta.discourse.org/t/always-allow-username-based-password-reset/409326
**Category:** Feature
**Tags:** login
**Created:** [August 5, 2026, 1:53am UTC](https://meta.discourse.org/t/always-allow-username-based-password-reset/409326 "2026-08-05T01:53:33Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@roke\_julian\_lockhart](https://meta.discourse.org/u/roke_julian_lockhart)
#### Post date: [August 5, 2026, 1:53am UTC](https://meta.discourse.org/t/always-allow-username-based-password-reset/409326/1 "2026-08-05T01:53:33Z")
OpenAI, recently, disconnected their SSO integration; instead, silently replacing it with an e-mail address inherited from the user’s OpenAI account, and no password bound by default. Because I utilise an e-mail alias service for each account, this required that I correctly presume that this had occurred:
> [@How should a user request a password reset when they do not remember the e-mail address that one of their accounts utilises?](https://meta.discourse.org/t/how-should-a-user-request-a-password-reset-when-they-do-not-remember-the-e-mail-address-that-one-of-their-accounts-utilises/409201/9):
>
> ah yeah that’s a reasonable case… though I’d imagine an email alias service should keep some record of which aliases have been used where? Apple’s does but I don’t have experience with others to know for sure. Maybe worth opening a feature request to always allow username for password resets? if others are running into this issue it’s something we could consider having
This may not be an intuitive process for the average user (not that I’m special, though).
I would prefer to also be able to utilise the account’s `id`, but that appears to be less popular than usernames, whenever I discuss it. Additionally, it would solely be in addition to this, so it’s probably out-of-scope.
---
### Author:  [@southpaw](https://meta.discourse.org/u/southpaw)
#### Post date: [August 5, 2026, 4:39am UTC](https://meta.discourse.org/t/always-allow-username-based-password-reset/409326/2 "2026-08-05T04:39:16Z")
Just adding for reference that it’s the `hide_email_address_taken` site setting that, when enabled, (and as [noted](https://meta.discourse.org/t/how-should-a-user-request-a-password-reset-when-they-do-not-remember-the-e-mail-address-that-one-of-their-accounts-utilises/409201/14) by @moin, this setting is enabled by default) requires the forgot password form to accept only the full email address. The option to enter a username in that field exists only when the setting is disabled.
I’m having trouble imagining how entering a username there would reveal the existence of a “taken” email address, since we don’t display any part of that email address on the webpage (or anywhere that I saw in the console) after the form has been submitted with a username.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [August 6, 2026, 11:51am UTC](https://meta.discourse.org/t/always-allow-username-based-password-reset/409326/4 "2026-08-06T11:51:29Z")
> [@southpaw](#):
>
> that it’s the `hide_email_address_taken` site setting that, when enabled, (and as [noted](https://meta.discourse.org/t/how-should-a-user-request-a-password-reset-when-they-do-not-remember-the-e-mail-address-that-one-of-their-accounts-utilises/409201/14) by @moin, this setting is enabled by default) requires the forgot password form to accept only the full email address.
That’s new. How is it helping? Were people harassing people by sending password resets? It’s quite common for users on old communities not to know what email address they subscribed with.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [August 6, 2026, 12:05pm UTC](https://meta.discourse.org/t/always-allow-username-based-password-reset/409326/5 "2026-08-06T12:05:43Z")
> [@southpaw](#):
>
> Just adding for reference that it’s the `hide_email_address_taken` site setting that, when enabled, (and as [noted](https://meta.discourse.org/t/how-should-a-user-request-a-password-reset-when-they-do-not-remember-the-e-mail-address-that-one-of-their-accounts-utilises/409201/14) by @moin, this setting is enabled by default) requires the forgot password form to accept only the full email address
Wait. What? Why does hiding the email address stop you from being able to reset your password? It used to do this with a message like ‘the email has been sent’, I thought. And the message for using the email address was like “if that email is here, we sent a mage”
Requiring the email address for password reset is a terrible idea. I’m surprised that this hadn’t been seen as a problem sooner.
Oops. Sorry that I sent two replies.
---
### Author:  [@awesomerobot](https://meta.discourse.org/u/awesomerobot)
#### Post date: [August 6, 2026, 9:18pm UTC](https://meta.discourse.org/t/always-allow-username-based-password-reset/409326/6 "2026-08-06T21:18:49Z")
This was an intentional change made here originally: [FEATURE: hide\_email\_address\_taken forces use of email in forgot password form - Pull Request #15362 - discourse/discourse - GitHub](https://github.com/discourse/discourse/pull/15362)
> This strengthens this site setting which is meant to be used to harden sites
> that are experiencing abuse on forgot password routes.
>
> Previously we would only deny letting people know if forgot password worked on not
> **New change also bans usage of username for forgot password when enabled**
So not sure if @sam has any thoughts on walking this back for usernames, at the time of the change it wasn’t the default state, but as of ~2024 it is. I think the risk of allowing usernames is pretty low, someone could potentially use it to send any random user a bunch of emails… but it should be rate limited.