How Long Does It Take to Reset a Password?

Forgetting a password can feel like being locked out of your own digital life. The good news is that most password resets are completed in a few minutes when you can still access the email address, phone number, app, or device connected to the account.

The process takes longer when the service cannot quickly confirm that you are the real account owner. For example, you may have changed your phone number, lost access to your recovery email, or triggered a security lock by entering the wrong password too many times. In those situations, a simple password reset can become a full account recovery, which may take hours or several days.

Quick Answer

A normal password reset usually takes about 5 to 15 minutes. Email links and text-message codes often arrive within a few minutes, and you can create a new password as soon as your identity is verified. A temporary security lock may extend the process to several hours. If you cannot access your recovery email, phone, trusted device, or backup codes, full account recovery may take several days or longer. Google says recovery requests can be delayed for hours or days, while Apple warns that its account-recovery waiting period may last several days or more.

Typical Password Reset Timeline

Situation	Typical time
Changing a password you still know	About 1 to 5 minutes
Reset link sent to an accessible email account	About 5 to 15 minutes
Verification code sent by text message	Usually a few minutes
Verification through an authenticator app or trusted device	Usually a few minutes
Temporary lock after repeated attempts	Until the service’s stated waiting period ends
School or workplace account requiring an administrator	A few minutes to the next business day
Full account recovery without normal verification methods	Several hours to several days or longer

These are general estimates, not universal deadlines. Each service sets its own verification rules, lockout periods, and support procedures.

Resetting, Changing, and Recovering a Password

These terms sound similar, but they describe different situations.

Changing a password

You know your current password and can sign in normally. You open the security settings, enter the current password, and choose a new one. This is usually the fastest option.

Resetting a password

You forgot the password but can prove your identity another way. The service might send a link to your email, text a code to your phone, ask you to approve a notification on a trusted device, or accept a saved recovery code.

Recovering an account

You cannot use the password or the normal recovery methods. The service must perform additional checks before allowing access. This slower process helps prevent another person from taking over your account by pretending to be you.

What Happens During a Password Reset?

Most password resets follow the same basic steps:

You select “Forgot password?” The service asks for your username, email address, or telephone number.
The service checks the request. It may look at the device, location, and recent account activity for signs that the request is legitimate.
You verify your identity. You may receive an email link, text code, app notification, or prompt on a trusted device.
You create a new password. The new password must meet the service’s length and security requirements.
The service updates the account. You can usually sign in immediately, although some apps and devices may ask for the new password separately.
A security notice is sent. Many services notify the account’s email address or phone number so the owner can report an unauthorized reset.

The password change itself takes only seconds. Most of the waiting comes from receiving the verification message or proving that the account belongs to you.

What Can Delay a Password Reset?

The reset email has not arrived

Email can be delayed by a spam filter, a misspelled address, a full mailbox, or a temporary mail-service problem. The message may also be placed in a junk, promotions, updates, or quarantine folder.

The text code is delayed

A weak cellular signal, carrier delay, incorrect phone number, or blocked short-code message can prevent a verification text from appearing. Repeatedly requesting codes may invalidate earlier ones, so use the most recent code and follow any waiting instructions shown on the screen.

Your recovery information is outdated

If the account still lists an old phone number or inaccessible email address, the normal reset route may not work. The service may direct you to account recovery or require help from an administrator.

You entered the wrong information too many times

Websites may temporarily limit reset or sign-in attempts when they detect repeated failures. This is called a security lock or rate limit. It slows down automated guessing by hackers, but it also means the real owner may have to wait.

The request looks unusual

A new device, different country, private-browsing session, or sudden change in account activity may trigger additional verification. Using a familiar device, browser, and location can sometimes make it easier for a service to recognize you.

Multi-factor authentication is unavailable

Multi-factor authentication, often shortened to MFA, asks for a second form of proof in addition to a password. That proof might be a phone code, authenticator app, security key, or trusted device.

MFA can make a routine reset faster when you still have the second method. It can make recovery slower if you lost the phone or security key and did not save backup codes.

A school or employer controls the account

Students and employees may not be allowed to reset an account without help. A teacher, school technology office, company help desk, or account administrator may need to verify the person and issue a temporary password. Timing depends on when that support team is available.

Why Full Account Recovery Can Take Days

Account recovery is deliberately slower than an ordinary reset because the service has fewer reliable ways to know who is making the request.

Google states that account-recovery requests may be delayed for a few hours or several days, depending on security risks. Apple says that after account recovery begins, the confirmation notice may take up to 72 hours and the complete waiting period may last several days or longer. Apple also says its support staff cannot shorten that waiting period.

These delays can be frustrating, but immediately handing over an account after someone claims to have lost a phone would make account theft much easier. During a recovery delay:

follow the instructions from the service;
watch the recovery email or phone number for updates;
avoid repeatedly starting new recovery requests;
keep any trusted device signed in unless the provider tells you otherwise; and
do not pay anyone who promises to bypass the waiting period.

No outside company or “recovery expert” can legitimately override Google, Apple, Microsoft, a school, or another provider’s security process.

What to Do When the Reset Email or Code Does Not Arrive

Work through these steps in order:

Wait a few minutes. A short delivery delay is common.
Check every email folder. Look in Spam, Junk, Promotions, Updates, and any school or workplace quarantine folder.
Search for the service’s name. The message may be present but buried under newer email.
Confirm the displayed destination. Make sure the hidden part of the email address or phone number matches your recovery information.
Check your connection and phone signal. Turn off airplane mode and make sure the device can receive ordinary messages.
Request one new link or code. Use the newest one because requesting another may cancel the earlier code.
Go directly to the official website or app. Do not use a password-reset link from an unexpected message.
Use another approved recovery method. Choose a trusted device, authenticator app, recovery code, or administrator if offered.

If the service displays a waiting period, stop submitting new requests and follow its instructions. Repeated attempts can extend a security lock on some systems.

How to Reset a Password Safely

Password-reset messages are commonly copied by scammers. A fake message may claim that your password expired or that someone accessed your account. The link then opens a convincing imitation of the real sign-in page.

To reset a password safely:

Open the company’s official app or type its known website address yourself.
Check that the account name or username is correct before continuing.
Never give a verification code, backup code, password, or authenticator approval to another person.
Do not approve a sign-in notification you did not request.
Avoid resetting important accounts on public computers.
Contact the school, employer, bank, or service through a known telephone number if the instructions seem unusual.

Legitimate support workers should not ask you to tell them your new password.

How to Choose the New Password

The new password should be both strong and different from every other password you use. Reusing a password is dangerous because a criminal who obtains it from one website may try it on your email, social media, gaming, or school accounts.

Current National Institute of Standards and Technology guidance supports:

using a long password or passphrase;
allowing password managers to create and store unique passwords;
checking new passwords against lists of commonly used or compromised passwords; and
changing a password when there is evidence it was exposed, rather than forcing changes on an arbitrary schedule.

A password manager is an app that securely stores passwords so you do not have to memorize every one. Protect the password manager itself with a strong main password and MFA.

Do not turn a compromised password into a slightly different one by adding a number. Create a completely new password that is not based on your name, birthday, school, pet, or team.

What Should You Do After the Reset?

Once the new password works:

Sign out of other devices or sessions if the service offers that choice.
Review recent logins, devices, purchases, and security changes.
Remove recovery email addresses, phone numbers, or devices you do not recognize.
Update the password in your password manager.
Update apps that repeatedly ask for the old password.
Turn on MFA and save the recovery codes somewhere secure.
Change the password anywhere else you reused the old one.

If you did not request the reset, treat the message as a warning. Go directly to the real service, check recent activity, secure the account, and update the recovery information.

If you are restoring account access, troubleshooting a device, or completing another technology task, these related guides may also help:

Frequently Asked Questions

Can a password reset happen instantly?

Yes. If the service immediately recognizes your device and you can use its verification method, the reset may take only a minute or two.

Why does my password-reset link say it expired?

Reset links are temporary. The link may also stop working after you request a newer one or use it successfully. Return to the official sign-in page and request a new link.

Can I reset a password without access to my email?

Sometimes. The service may offer a telephone number, trusted device, authenticator app, backup code, recovery contact, or support process. If none is available, full account recovery may be required.

Why am I locked out after too many attempts?

The service is limiting attempts to prevent someone from repeatedly guessing your password or verification code. Wait for the displayed period instead of continuing to try.

Will resetting a password log me out everywhere?

It depends on the service. Some accounts end other sessions automatically, while others give you a choice. For a compromised account, select the option to sign out other devices when available.

Is a password the same as a phone or computer PIN?

No. An account password usually works across devices and online services. A PIN or device passcode may unlock only that particular phone or computer. Changing one does not always change the other.

Do password managers help with password resets?

They can prevent many resets by remembering unique passwords. They can also generate a new password and save it immediately after a reset.

Should I change all my passwords regularly?

Not simply because a certain number of days passed. Current NIST guidance says services should not require arbitrary periodic password changes. Change a password promptly when it may have been exposed, reused on a breached site, shared, or entered on a suspicious page.

Quick Summary

A routine password reset normally takes about 5 to 15 minutes when you can receive an email link, text message, app prompt, or verification code. The reset itself is fast; most delays occur while the service is checking your identity or delivering the verification message.

The process can take much longer when you no longer control the recovery email, phone, trusted device, or backup codes. At that point, the reset becomes account recovery. Depending on the provider and the security risk, recovery may take several hours, several days, or longer. Temporary locks and school or workplace administrator requirements can also add time.

Use the service’s official app or website, and never give a verification code or new password to someone who contacts you. After regaining access, review the account for unfamiliar activity, sign out unrecognized devices, update the recovery information, enable multi-factor authentication, and replace the password anywhere else it was reused.

A long, unique password stored in a reputable password manager is easier to manage and safer than reusing a familiar password. Regular password changes are not necessary simply because time has passed, but a password should be replaced immediately if it may have been exposed.

Sources & References

Editorial Review

Reviewed by Claire Bennett, Managing Editor
Last reviewed: July 2026

Quick Answer Guide publishes practical, research-based answers to common questions about money, technology, health, travel, home improvement, and everyday life. Content is reviewed using official government resources, educational institutions, industry publications, and other authoritative sources when appropriate. Articles are updated periodically to improve accuracy and usefulness.