The Reset Door: Twenty UK Apps, One Blank Memory and the Tell-Tale Email

There is a particular kind of quiet panic that arrives when your phone asks for a password and your brain offers nothing but the sound of a kettle boiling in the next room. Not a hack, not a breach — just a blank. So at 124apps we spent a grey November 2026 week deliberately forgetting the passwords to twenty everyday UK apps, then timing the rescue mission. Banking, energy, supermarket, rail, streaming, parking, pharmacy, council, gym, delivery — the usual cast. We used our own accounts, changed nothing important, and wrote down every hoop, delay and small humiliation.

This was not a security audit. It was a usability test with a bad memory and a stopwatch. The question was simple: when you are already mildly annoyed with yourself, does the app make getting back in feel like a locked door with a helpful sign, or a locked door with a fake plant and no handle?

How we tested the reset door

For each app we opened the login screen, chose the 'forgotten password' route, and started a timer. We recorded the first message shown, whether it confirmed an account existed, what fallback options appeared, how long the email took to arrive, whether the link worked first time, and whether the app logged out other devices after the reset. We also noted the tone. A surprising amount of the experience is tone.

We tried each reset twice where possible: once on wi-fi at a desk, once on mobile data on a bus. That second setting matters. Half the country is not sitting calmly at a laptop when this happens.

The tell-tale email

The first split was philosophical. Some apps say, in effect, 'If an account exists for that address, we have sent a message.' Others say, 'We do not recognise that email.' The first is the polite, security-minded approach: it gives nothing away to someone probing for accounts. The second is clearer if you genuinely cannot remember which address you used, but it also quietly confirms whether a person is registered. Across our twenty apps, eleven used the neutral wording, six were explicit, and three managed to be confusing in a new way — a spinner, then a generic error, then an email arrived anyway.

The neutral wording is not just security theatre. It is also kinder. When you are already flustered, 'check your inbox if an account exists' is a small, calm instruction. 'No account found' is a dead end that sends you hunting through old email addresses while the bus announces the wrong stop.

The hoop count

A reset flow can be one hoop or a whole assault course. The quickest app in our test was done in two minutes forty seconds: email arrived, link opened, new password set, back to the home screen. The slowest took nineteen minutes, mostly because the email took eight minutes to arrive and the link then expired while we were looking for a signal.

Most sat between four and eight minutes. The usual sequence was email link, then a six-digit code by text, then a new password that had to be different from the old one and contain a symbol we had not used before. One app asked for a postcode, a date of birth and the last four digits of a card. Another asked us to open the app on a device we were already locked out of. That is not a reset flow; that is a riddle with a doorstep.

Mobile-number fallbacks were the most reliable when they existed. But six apps still had an old number on file, and changing it required — you guessed it — logging in first. That is the forgotten-password equivalent of locking the spare key inside the house.

The device logout question

After a successful reset, we checked the other devices signed into the account. This is where the apps separated into adults and teenagers. The banking and energy apps generally logged out every session and told us plainly that they had done so. Good. The streaming, parking and gym apps mostly left other devices signed in. Some people will prefer that. But when you have just reset a password because you are worried, 'all other devices have been signed out' is a reassuring sentence, not a threat.

The awkward middle ground was an app that logged out our phone but kept a tablet signed in, then sent a push notification to the tablet asking if it was us. We were holding the tablet at the time. It felt like being asked to vouch for ourselves.

The small humiliations

There is a special category of annoyance that has nothing to do with security. One app made us watch a thirty-second advert before showing the reset form. Another demanded a password with an uppercase letter, a number, a symbol and no recognisable words, then rejected our new password because it contained our name. Fair enough, but the error message appeared only after the second attempt.

Two apps sent the reset email to spam. One link expired in ten minutes. Three apps asked us to update the app before we could reset the password, which is a strange time to be told about a new version. And one council app offered a 'contact us' link that opened a blank page. We never did get back into that one.

The most human moment came from a supermarket app that showed a simple line: 'No rush. The link lasts an hour.' After six apps that treated a reset link like a mayfly, that felt almost generous.

What a good reset door looks like

Our favourites were not the flashiest. They were the ones that kept the language plain, sent the email quickly, offered a text fallback, and told us exactly what would happen to other devices. None of them made us feel stupid. That is a low bar, but twenty apps showed it is not a universal one.

If we were writing the rules for UK app teams, we would start with three: use neutral wording, give a realistic expiry window, and do not send people to a dead end when their mobile number is out of date. A reset flow is not the place for cleverness. It is the place for a clear sign, a working handle and a door that opens.

At 124apps, we are not against security hoops. We are against hoops that appear without explanation. A forgotten password is already a small defeat. The app's job is to make the next two minutes feel like a fix, not a punishment.