Which design type is this question?

It is a security system question. You design a forgot password flow and explain your choices the way you would in an interview.

Is this question asked at entry level?

It is marked Medium. Entry-level engineers can practise it, but it expects you to reason about requirements and trade-offs, not only list components.

What should I cover first?

Start with what must be protected, from whom and what a breach would cost. Agree on scope with the interviewer before you design anything.

Can I practise it for free?

It is a premium question. Sign up and unlock it once for 10 credits; it then stays unlocked. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.

Design a forgot password flow

PremiumSecurity systemMedium

Security
Authentication
Password reset

Quick answer

This security system interview question asks you to design a forgot password flow. Aim for a design that protects users and data without blocking legitimate use, then explain the threats, controls, detection and trade-offs. Interviewers want to see how you model threats and layer defences.

The problem

Design a secure password recovery system that verifies user identity and allows users to reset their password safely.

What must a forgot password flow do?

Users can request a password reset using email, phone number, or username.
The system should send a reset link or verification code through email or SMS.

5 more requirementsUnlock to see all

How well must it do it?

The flow should be secure against brute-force, replay, and enumeration attacks.
The system should avoid revealing whether an account exists.

5 more requirementsUnlock to see all

What scale should you design for?

Use these numbers in your estimates.

The scale numbers unlock with this questionUnlock

Key concepts

Security
Authentication
Password reset
Email sms
Rate limiting
Token management

How you’ll practise

6 short steps · save and come back any time

Requirements and assets
Threat model
Identity and access
Data protection
Detection and response
Wrap-up

Lala, personalized to you, gives a hint when you ask and reviews your design when you are ready.

What do interviewers look for?

In any security system design round.

Starts with a clear threat model
Layers defences instead of relying on one control
Covers authentication, authorisation and secrets
Plans detection, alerting and response
Protects data in transit and at rest
Balances security against usability and cost

Questions people ask about this interview question

Which design type is this question?: It is a security system question. You design a forgot password flow and explain your choices the way you would in an interview.
Is this question asked at entry level?: It is marked Medium. Entry-level engineers can practise it, but it expects you to reason about requirements and trade-offs, not only list components.
What should I cover first?: Start with what must be protected, from whom and what a breach would cost. Agree on scope with the interviewer before you design anything.
Can I practise it for free?: It is a premium question. Sign up and unlock it once for 10 credits; it then stays unlocked. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.

The problem

What must a forgot password flow do?

How well must it do it?

What scale should you design for?

Key concepts

How you’ll practise

What do interviewers look for?

Questions people ask about this interview question

Related questions