How to test a password reset email manually with a temporary inbox
Updated 4 November 2026.
For an application you own or are authorised to test, a temporary inbox can help check the reset email, its link and the result of setting a new password. Use a disposable test account rather than a real customer account.
Prepare a controlled test
Create a test account in your development or staging application using an active temporary inbox. Record the expected sender, subject, link destination and expiry behaviour. Use dummy data and a unique test password. Confirm that your application accepts disposable addresses in this environment. Leave enough inbox lifetime for the entire test; a message that arrives after inbox expiry cannot be inspected there.
Check the email without exposing the reset token
Request one reset through your application’s normal interface. Open the message in 1hemail and inspect its sender, subject, visible instructions and plain-text fallback. Confirm that the destination belongs to your expected application before following it. Do not paste the private reset URL into public link analysers, issue trackers or screenshots. A reset token should be treated as a credential.
Check the actual reset outcome
Open the intended link in the browser context your application supports, set a new test password and verify that the test account can sign in with it. Check the old password according to your application’s intended policy. Requesting a reset and receiving an email alone do not establish that the full flow works. Never use these steps on accounts you do not control.
Check expired, reused and superseded links
Use separate controlled cases for a link after its expiry, a link already used successfully, and an older link after requesting another reset. Compare the observed behaviour with your application’s documented rules. Do not assume every application invalidates earlier links in exactly the same way. The inbox timer is independent of your application’s token timer.
Keep useful evidence
Save the original .eml before inbox expiry when you need to inspect encoding, headers or MIME structure. Redact addresses, links, tokens and passwords from anything shared with a developer. Filtered formatted mail can omit sender styling, so check the actual target mail clients when validating pixel-level layout. See saving original messages and the signup email testing guide.
Know when to use an automated testing platform
1hemail currently provides manual receiving, not a supported public automation API, and does not send replies. For repeatable CI tests, evaluate an appropriate testing provider and its current plan limits. Mailinator’s official API documentation describes retrieving messages and links for verification workflows. This guide covers a manual checklist, not an integration or guaranteed delivery benchmark.