# Do not leak emails on password reset
**URL:** https://meta.discourse.org/t/do-not-leak-emails-on-password-reset/176149
**Category:** Support
**Created:** [January 14, 2021, 9:38pm UTC](https://meta.discourse.org/t/do-not-leak-emails-on-password-reset/176149 "2021-01-14T21:38:54Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Soni](https://meta.discourse.org/u/Soni)
#### Post date: [January 14, 2021, 9:38pm UTC](https://meta.discourse.org/t/do-not-leak-emails-on-password-reset/176149/1 "2021-01-14T21:38:54Z")
Currently emails can be leaked by requesting a password reset. It is possible to throw emails at the software and see which emails have accounts and which ones don’t, without having access to said emails. This is extremely dangerous.
---
### Author:  [@awesomerobot](https://meta.discourse.org/u/awesomerobot)
#### Post date: [January 14, 2021, 9:44pm UTC](https://meta.discourse.org/t/do-not-leak-emails-on-password-reset/176149/2 "2021-01-14T21:44:54Z")
This is not a bug. We have a site setting called `hide email address taken` that prevents it.
There are also rate-limits on sign in so it’s not particularly easy to brute force large numbers of email addresses.
---
### Author:  [@Soni](https://meta.discourse.org/u/Soni)
#### Post date: [January 14, 2021, 9:46pm UTC](https://meta.discourse.org/t/do-not-leak-emails-on-password-reset/176149/3 "2021-01-14T21:46:57Z")
That should not be behind a setting…
---
### Author:  [@awesomerobot](https://meta.discourse.org/u/awesomerobot)
#### Post date: [January 14, 2021, 9:49pm UTC](https://meta.discourse.org/t/do-not-leak-emails-on-password-reset/176149/4 "2021-01-14T21:49:42Z")
It’s a trade-off between usability and security (lots of things are). It’s common for people to be frustrated by trying to log in with the wrong email address, and letting them know it doesn’t exist can help. For sites that need the extra security, the option is there.
We’ve got other measures in place to reduce the risk and haven’t encountered significant problems with it across hundreds of Discourse sites.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [August 1, 2023, 8:07am UTC](https://meta.discourse.org/t/do-not-leak-emails-on-password-reset/176149/5 "2023-08-01T08:07:20Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.