Type: FAQ
Category: Umbraco CMS > Security
Tags: password reset, reset link expired, token expired, token lifespan, TokenLifespan, DataProtectionTokenProviderOptions, member password reset, user password reset, ASP.NET Identity, invalid token
Product: Umbraco CMS
Version: All versions
Summary
A password reset link is valid for 24 hours, for both members and back office users. This is the ASP.NET Identity default, which Umbraco does not override. You can change it, but the change applies to members and users together.
Why 24 hours
Umbraco uses ASP.NET Identity for authentication, and password reset links carry a token generated by Identity's default token provider. That provider's TokenLifespan defaults to one day, and Umbraco leaves it as it is.
The Umbraco documentation states this for back office users: "This link contains a random token for this user that is valid for 24 hours." The same applies to members, even though the documentation does not say so explicitly.
If a reset link is used after that window, it fails as an invalid or expired token, and the person needs to request a new one.
Changing the duration
Configure DataProtectionTokenProviderOptions in Program.cs, or from a composer if you prefer to keep it out of startup:
builder.Services.Configure<DataProtectionTokenProviderOptions>(options =>
{
options.TokenLifespan = TimeSpan.FromHours(48);
});Adjust the value to whatever suits your site.
Before you change it
The setting is not specific to password reset. TokenLifespan governs the shared data protection token provider, so the new duration applies to other tokens issued by that provider as well, such as email confirmation. It is not a password-reset-only switch.
It applies to members and back office users together. There is no way to give members a different reset window from your back office users through this setting.
A longer window is a weaker one. A reset link that stays valid for two days is a link that stays usable for two days in whatever inbox it landed in, including a compromised one. Extend it because you have a reason to, not by default.
Recommended documentation
Still have questions?
If you are chatting with Umboto right now, type "talk to human" and we will connect you with someone who can help.
If you are reading this article in the Help Center, contact us by clicking at the messenger icon at the bottom right.
Last updated on August 26, 2026