# Different password reset for wrong username/email

**URL:** <https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909>\
**Category:** Feature\
**Created:** [23. Mai 2014 um 14:16 UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909 "2014-05-23T14:16:30Z")\
**Posts on this page:** 1\
**Showing post:** 22

<div class="post-metadata">

**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\
**Post date:** [8. September 2014 um 08:40 UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/22 "2014-09-08T08:40:42Z")

</div>

@amyehawthorne we have had a bit of a change of heart on this. While the general philosophy is we like to ship Discourse as safe and secure as possible, in _this specific case_ we think we should optimize for reducing the most common support requests over security.

So, @sam is going to make it so that the password reset **will tell you if no email or username exists** by default.

There will be a site setting to disable this behavior and opt in to the previous more secure behavior where we don’t tell you if the account or email exists, and “pretend” to send an email.

---

_[View the full topic](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909)._