How to Reset Password in Firebase Auth

1import { getAuth, sendPasswordResetEmail } from 'firebase/auth';
2
3const auth = getAuth();
4
5async function handlePasswordReset(email: string) {
6  try {
7    await sendPasswordResetEmail(auth, email);
8    // Always show success message even if email doesn't exist
9    // This prevents email enumeration attacks
10    console.log('Password reset email sent');
11  } catch (error: any) {
12    switch (error.code) {
13      case 'auth/invalid-email':
14        console.error('Invalid email address format');
15        break;
16      case 'auth/too-many-requests':
17        console.error('Too many attempts. Please try again later.');
18        break;
19      default:
20        console.error('Error sending reset email:', error.message);
21    }
22  }
23}

1import { getAuth, sendPasswordResetEmail, ActionCodeSettings } from 'firebase/auth';
2
3const auth = getAuth();
4
5const actionCodeSettings: ActionCodeSettings = {
6  url: 'https://your-app.com/auth/reset-complete',
7  handleCodeInApp: true
8};
9
10async function sendReset(email: string) {
11  try {
12    await sendPasswordResetEmail(auth, email, actionCodeSettings);
13    console.log('Reset email sent with custom redirect');
14  } catch (error: any) {
15    console.error('Error:', error.message);
16  }
17}

1// Server-side: Generate a custom reset link with Admin SDK
2import { getAuth } from 'firebase-admin/auth';
3
4async function generateCustomResetLink(email: string) {
5  const auth = getAuth();
6  const actionCodeSettings = {
7    url: 'https://your-app.com/auth/reset-complete'
8  };
9
10  const link = await auth.generatePasswordResetLink(
11    email,
12    actionCodeSettings
13  );
14
15  // Send the link via your own email service
16  // await sendCustomEmail(email, link);
17  return link;
18}

1import {
2  getAuth,
3  verifyPasswordResetCode,
4  confirmPasswordReset
5} from 'firebase/auth';
6
7const auth = getAuth();
8
9async function handleResetAction(oobCode: string, newPassword: string) {
10  try {
11    // Verify the code is valid and get the associated email
12    const email = await verifyPasswordResetCode(auth, oobCode);
13    console.log('Reset code valid for:', email);
14
15    // Confirm the password reset
16    await confirmPasswordReset(auth, oobCode, newPassword);
17    console.log('Password has been reset successfully');
18
19    // Optionally sign the user in automatically
20    // await signInWithEmailAndPassword(auth, email, newPassword);
21  } catch (error: any) {
22    switch (error.code) {
23      case 'auth/expired-action-code':
24        console.error('Reset link has expired. Please request a new one.');
25        break;
26      case 'auth/invalid-action-code':
27        console.error('Reset link is invalid or has already been used.');
28        break;
29      case 'auth/weak-password':
30        console.error('Password is too weak. Use at least 6 characters.');
31        break;
32      default:
33        console.error('Error resetting password:', error.message);
34    }
35  }
36}

1import { useState, useEffect } from 'react';
2import {
3  getAuth,
4  sendPasswordResetEmail,
5  verifyPasswordResetCode,
6  confirmPasswordReset
7} from 'firebase/auth';
8
9function PasswordReset() {
10  const auth = getAuth();
11  const [email, setEmail] = useState('');
12  const [newPassword, setNewPassword] = useState('');
13  const [message, setMessage] = useState('');
14  const [oobCode, setOobCode] = useState<string | null>(null);
15
16  useEffect(() => {
17    const params = new URLSearchParams(window.location.search);
18    const code = params.get('oobCode');
19    if (code) setOobCode(code);
20  }, []);
21
22  const handleSendReset = async () => {
23    try {
24      await sendPasswordResetEmail(auth, email);
25      setMessage('Check your email for a reset link.');
26    } catch {
27      setMessage('Something went wrong. Try again.');
28    }
29  };
30
31  const handleConfirmReset = async () => {
32    if (!oobCode) return;
33    try {
34      await confirmPasswordReset(auth, oobCode, newPassword);
35      setMessage('Password reset! You can now sign in.');
36    } catch {
37      setMessage('Link expired or invalid. Request a new one.');
38    }
39  };
40
41  // Render either the request form or the confirm form
42}