What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
You can send password-reset emails over HTTPS through a provider API without configuring SMTP. The hard part is making the recovery flow resistant to account discovery, token theft, and automated abuse—and estimating cost without treating a listed rate as a guaranteed total bill. AWS SES documents an API sending path, and Postmark provides an authenticated Email API. In either case, the application must control token creation, validation, and account changes.
What a secure password-reset flow must do
A reset message carries a capability to change an account’s credentials. Treat it as an authentication flow, not just a transactional email. OWASP identifies user enumeration as a common weakness in forgot-password implementations and advises: “Return a consistent message for both existent and non-existent accounts.” (OWASP Forgot Password Cheat Sheet.)
As an Amazon Associate I earn from qualifying purchases.
- Accept the request without confirming whether the address has an account. Use the same outward message for existing and nonexistent accounts, and avoid an obvious timing difference. One practical design is to enqueue the request so account lookup does not produce a conspicuously faster response for unknown addresses.
- Limit repeated requests and guesses. Apply controls against automated reset submissions, such as per-account rate limits or other abuse controls. Rate-limit attempts to guess reset tokens as well.
- Create a strong, single-use token. Generate it with a cryptographically secure random generator. Make it long enough to resist practical guessing, associate it with one user, store it securely, and enforce a limited validity period.
- Validate before changing account state. Opening a link must not itself change credentials. Verify that the token is valid, unexpired, and unused before allowing the user to set a new password. Invalidate it after use. OWASP describes URL tokens as the simplest and fastest implementation path.
- Use a trusted reset origin. Build the URL from a hard-coded or allow-listed application domain, not an untrusted inbound Host header, and require HTTPS. On the reset page, set
Referrer-Policy: no-referrerto reduce the chance that the URL token is passed to third parties. - Complete recovery like an ordinary password change. Apply the application’s normal password policy and password-storage practices. After a successful reset, notify the user that the password changed; never send the password itself by email.
Keep the email narrowly focused: explain why it was sent, provide the trusted reset link, state an expiry only if the server actually enforces that duration, and tell an unexpected recipient how to contact support. These copy choices follow from the security controls above; they are not a substitute for enforcing them in the application.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsChoose an API-only sending path
“No SMTP” means your application makes an authenticated HTTPS request to the provider rather than connecting to an SMTP server. Keep provider credentials on the server, never in browser code. Neither API choice removes the need to configure a sender identity or protect credentials.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Provider | API path and setup | Access control and operations | Pricing evidence |
|---|---|---|---|
| Amazon SES | AWS documents sending through its API, including raw HTTP requests; an AWS SDK can also call the API. SMTP is a separate documented option, not a requirement for API sending. See Set up email sending with Amazon SES. | Use IAM permissions limited to the required sending action and permitted sender identity; AWS documents restrictions for sending actions and sender and recipient addresses. See Identity and access management in Amazon SES. | The AWS à-la-carte outbound rate listed on the pricing page accessed October 7, 2026, is $0.10 per 1,000 emails, with attachment data charged separately. Other plans and services have separate terms. See Amazon SES pricing. |
| Postmark | Postmark documents an HTTPS Email API using the X-Postmark-Server-Token request header. The sender address must have a registered and confirmed Sender Signature. Its API documentation includes a “Password Reset” subject example. See Email API and API overview. |
The documented response includes a MessageID. Retain that provider identifier with an internal reset-request correlation ID for support and troubleshooting, but do not log raw reset tokens. |
A directly comparable Postmark price is not stated in the cited API documentation. |
The cited documentation establishes API mechanics, not comparative inbox placement. It does not support a claim that either provider delivers better. Choose based on your existing cloud setup, sender verification and permissions workload, pricing model, and operational needs.
Estimate the sending cost without overstating it
For AWS SES à-la-carte outbound email, AWS listed a rate of $0.10 per 1,000 emails on its pricing page accessed October 7, 2026. AWS also listed $0.12 per GB of attachment data sent. The page describes this à-la-carte mode as having no minimum fees or mandatory service usage. These figures are specific to that pricing mode and the page as accessed; verify the current price and selected plan before deployment.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For a plain reset email with no attachments, estimate the direct outbound charge as:
number of emails / 1,000 × $0.10
For example, 10,000 emails at the listed à-la-carte rate would calculate to $1 in direct outbound email charges, before any other applicable services or costs. If messages include attachments, account for attachment data using the listed rate. Password-reset messages normally have no need for attachments, so avoid adding them unless there is a specific product requirement.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
This calculation is not a total-cost guarantee. AWS also lists Essentials, Pro, and Enterprise plans with separate rates and monthly account or region fees for some plans. Validation, dedicated IPs, deliverability features, data transfer, or other selected AWS services may add costs or change the pricing basis. Do not combine a plan’s terms with the à-la-carte rate when estimating.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Handle send results as an operational signal
An API accepting a request does not prove that the message reached the recipient’s inbox. Record the provider’s message identifier when available, associate it with an internal reset-request correlation ID, and handle API failures so a user is not silently left without a recovery path. For Postmark, the documented response includes a MessageID. Avoid recording the raw reset token in application logs or support records.
Quick Recap
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
