When to use this
Forgot-password flows, admin-forced resets, expired-credential rotations. The reader is locked out, mildly annoyed, and staring at your login page in another tab. Their patience budget is measured in seconds, which is why this email has exactly one job and one button.
Design rules a reset email should follow
One button, high contrast, verb-first label. Below it, the same link as plain text, because corporate mail clients and some security filters mangle buttons, and a user who can't click needs something to paste. State the expiry honestly and make the link single-use; both are security hygiene and both reduce support tickets from stale links. The "if you didn't request this" line matters more here than anywhere: password mail makes people nervous, and telling them their password won't change unless the link is used prevents the panicked replies and the spam reports that come with them.
And nothing else. No product news, no banner, no "while you're here." A reset email carrying promotions is how your most security-critical mail starts inheriting your marketing complaints.
The template
Copy-ready, table-based so it renders everywhere, inline styles only. Swap the {{placeholders}} for your values or your template engine's variables.
<!DOCTYPE html>
<html lang="en">
<body style="margin:0;padding:0;background:#f4f5f7;font-family:Arial,Helvetica,sans-serif;">
<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background:#f4f5f7;padding:24px 0;">
<tr><td align="center">
<table role="presentation" width="440" cellpadding="0" cellspacing="0"
style="background:#ffffff;border-radius:8px;padding:32px;">
<tr><td style="font-size:18px;font-weight:bold;color:#111;padding-bottom:8px;">
{{company_name}}
</td></tr>
<tr><td style="font-size:14px;color:#444;line-height:1.5;padding-bottom:20px;">
We received a request to reset the password for {{user_email}}.
This link works once and expires in {{expiry_minutes}} minutes.
</td></tr>
<tr><td align="center" style="padding-bottom:20px;">
<a href="{{reset_url}}"
style="display:inline-block;background:#111;color:#ffffff;text-decoration:none;
font-size:15px;font-weight:bold;border-radius:6px;padding:13px 28px;">
Reset password
</a>
</td></tr>
<tr><td style="font-size:12px;color:#666;line-height:1.6;padding-bottom:16px;">
Button not working? Paste this link into your browser:<br>
<a href="{{reset_url}}" style="color:#3b6ecc;word-break:break-all;">{{reset_url}}</a>
</td></tr>
<tr><td style="font-size:12px;color:#888;line-height:1.5;">
If you didn't request this, you can safely ignore it. Your password
won't change unless the link above is used.
</td></tr>
</table>
<table role="presentation" width="440" cellpadding="0" cellspacing="0">
<tr><td style="font-size:11px;color:#999;padding:16px 8px;text-align:center;">
Sent by {{company_name}} · {{company_address}}
</td></tr>
</table>
</td></tr>
</table>
</body>
</html>Deliverability: the half that actually fails
A reset email that lands in spam is a locked-out user who stays locked out, and then becomes a support ticket, and sometimes a churned account. None of that traces back to the HTML. Send resets on a transactional stream separated from marketing, so a bad campaign week can never take your account-recovery mail down with it. Keep SPF, DKIM, and DMARC aligned: an unauthenticated email asking someone to click a password link looks exactly like phishing to a mailbox filter, because that's exactly what phishing looks like.
Latency is the other killer. The user requests a reset, waits, refreshes, requests again. If your sending is being throttled for reputation reasons, that delay is invisible to you and very visible to them. This is why reset mail belongs on infrastructure that paces reputation per domain in real time rather than finding out about problems days later. If resets are already going to spam, skip the redesign: run the free deliverability check first. It's nearly always auth, reputation, or list quality.
Related
- OTP Verification template: for code-based flows instead of links
- Email Verification template: the signup-time cousin of this email
- Transactional Email Service: the sending layer for account mail
- Transactional Email: the category, defined
- Login alert template: the security email that precedes the reset