The answer
Use a consistent response explaining that eligible accounts will receive instructions. Provide useful next steps without publicly confirming whether the supplied address belongs to an account.
Why should login errors avoid revealing whether an account exists?
How should a wedding app word the response to a password-reset request?
More FAQs in Why should login errors avoid revealing whether an account exists?
Yes. Format validation describes the user's input and does not require disclosing whether the account exists. Keep account lookup failures consistent across valid-looking addresses.
Other observable differences, including status behavior or avoidable response-time differences, may still distinguish account states. Review the entire response path rather than only the displayed text.
Still have questions?
Browse all our FAQs or reach out to our support team
Want to upskill yourself?
Your learning library
Small steps. Big possibilities.
Find your next course. Build something great.