Test password reset emails safely.

The problem with testing password resets

Password reset flows are critical infrastructure — a broken reset email means locked-out users and support tickets. But testing them is awkward: you either send to your own Gmail (slow, cluttered), use console logging (can't verify HTML rendering), or skip testing entirely (dangerous).

With MailHog, every reset email lands in your test inbox instantly. You can verify the subject line, check that the magic link URL is correct, confirm the token is present, and preview how the email renders across clients — all without touching a real email provider.

What to verify in a password reset email

Automate it in your test suite

The most reliable approach: trigger a password reset in your integration test, then use MailHog's API to fetch the captured email and extract the reset token. Your test can then follow the link and verify the complete flow end-to-end.

// 1. Trigger password reset
await fetch("/api/forgot-password", {
  method: "POST",
  body: JSON.stringify({ email: "user@test.com" }),
});

// 2. Fetch the email from MailHog
const emails = await mailhog.getMessages({ to: "user@test.com" });
const resetEmail = emails[0];

// 3. Extract the reset link
const resetUrl = resetEmail.html.match(/href="([^"]*reset[^"]*)"/)[1];

// 4. Follow the link and complete the reset
await fetch(resetUrl);
await fetch("/api/reset-password", {
  method: "POST",
  body: JSON.stringify({ token, newPassword: "new-secure-pw" }),
});

Related use cases