Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →After a successful password reset, invalidate the recovery link that was used, every other outstanding recovery link for that account, and any active sessions that could preserve an attacker’s access. If the recovery also puts OAuth access or refresh tokens at risk, revoke them through the authorization server separately. An OAuth token-revocation request does not invalidate an application’s emailed recovery URL: these are different credentials, issued and controlled by different systems.
What an “OAuth recovery link” means
OAuth is an authorization framework, not a standard for password-reset links. In most systems, the emailed recovery URL belongs to the application, even when the account uses OAuth to connect to other services. Its lifecycle is therefore separate from the lifecycles of OAuth authorization codes, access tokens, refresh tokens, and application sessions.
As an Amazon Associate I earn from qualifying purchases.
That distinction determines what must be revoked. OWASP’s Forgot Password Cheat Sheet covers recovery links and sessions; IETF RFC 7009 covers OAuth token revocation. A reset endpoint must not assume that calling one system’s revocation mechanism also invalidates credentials managed by another.
What to invalidate after a successful reset
- The presented recovery token: mark it consumed so it cannot be replayed.
- Other outstanding recovery credentials: invalidate links or codes previously issued for the account.
- Existing application sessions: invalidate them server-side so an attacker cannot continue using an already authenticated session.
- OAuth credentials at risk: assess whether access tokens, refresh tokens, or grants should also be revoked through the authorization server.
For reliable one-time use, consume the presented token and invalidate the account’s other outstanding recovery credentials as part of the same successful recovery operation. This is an implementation approach to OWASP’s single-use and post-recovery invalidation guidance; it is not an OAuth-defined transaction.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Build recovery links that can be safely revoked
Generate and store tokens securely
Generate each recovery token with a cryptographically secure random generator, make it sufficiently long to resist guessing, associate it with one account, and store it securely. Enforce single use and reject a token after it has been consumed or invalidated. These are application recovery controls, not properties supplied automatically by OAuth.
Set an expiry appropriate to the risk
Choose an expiry that fits the service’s risk and the user’s recovery journey. OWASP recommends expiration, but the cited guidance does not prescribe one universal duration for recovery links, and OAuth does not define one. IETF RFC 6819 discusses choosing expiration based on risk rather than establishing a universal recovery-link lifetime.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Protect issuance and redemption
- Use HTTPS for recovery URLs.
- Set a
no-referrerpolicy on the recovery page to reduce the chance that the token leaks through referrer information. - Rate-limit recovery requests and token guesses.
- Use consistent responses and timing for account-recovery requests so the endpoint does not reveal whether an account exists.
These measures address different failure paths: enumeration during issuance, brute force during redemption, and token leakage while a user opens the link.
Recommended Free Tools
Revoke OAuth tokens through the authorization server
If a password reset follows suspected compromise, decide whether OAuth credentials associated with the account are also exposed. Where they are, use the authorization server’s supported revocation behavior or administrative controls. RFC 7009 specifies an OAuth token-revocation endpoint; it does not define a way to revoke an application’s password-reset URL.
Rank #3
- USB-C or tap via NFC for easy authentication on any compatible device. No drivers needed; optional Kensington software available for advanced management features.
- Works across Windows, macOS, iOS, Android, ChromeOS, and supports Passkeys and Apple ID.
- Slim, keychain-ready form for easy carry and on-the-go authentication
- IP68-rated for dependable performance
- FIDO CTAP 2.1 for enhanced security features (e.g. resident credentials, Passkey support) and backwards compatibility with CTAP 2. FIDO2 L2 certified security for phishing resistant protection against identity theft and unauthorized access.
IETF RFC 9700, the OAuth 2.0 Security Best Current Practice, permits automatic refresh-token revocation in security events such as password change or authorization-server logout. That permission is not a guarantee that every provider revokes tokens after a password reset. Check the provider’s current behavior and connect the recovery event to the revocation mechanism it actually supports.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep OAuth authorization-code defenses separate
OAuth authorization codes are not account-recovery tokens. Under RFC 6749, authorization codes are short-lived and single-use. RFC 9700 requires public clients to use PKCE in authorization-code flows and says authorization servers should revoke tokens derived from a code if that code is redeemed more than once. These controls defend the OAuth flow; they do not replace single-use enforcement or revocation for recovery links.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
When a reset follows suspected account compromise
A password change alone may leave other ways for an attacker to regain access. Review recovery-address changes and compromised authenticators, invalidate relevant sessions and outstanding recovery credentials, and assess which OAuth tokens or grants remain trustworthy. The exact assurance checks depend on the service and its recovery policy; the cited standards do not prescribe one universal account-recovery procedure for every deployment.
Check the full revocation path
- Can the application invalidate all outstanding recovery links for one account?
- Does it enforce expiry and one-time use when a link is redeemed?
- Can successful recovery invalidate server-side sessions?
- Can the recovery event trigger revocation of affected OAuth tokens or grants through the authorization server?
- Are request enumeration, token guessing, and referrer leakage addressed?
- Does the recovery process review account recovery details and authenticators when compromise is suspected?
These checks assess whether recovery reaches every credential system involved. No single OAuth endpoint or standard makes all of those decisions for an application.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
