Test cases for forgot password and password reset

1. Tap Forgot password, enter a registered email and tap Send link
2. Open the reset email on the same phone and tap the link
3. Enter and confirm a new password, then tap Save
4. Sign in with the new password, then try the old one

Expected: The link opens the app's set-new-password screen and the new password signs in. The old password is rejected.

1. Tap Forgot password, choose the mobile number option and enter the number
2. Enter the OTP from the SMS
3. Set a new password and sign in with it

Expected: After the OTP is accepted, the set-new-password screen opens for that account. The new password signs in and the old one is rejected.

Why a real phone: Needs the reset OTP delivered by SMS to a live SIM.

1. Request a reset link, then uninstall the app
2. Tap the link in the email
3. Set a new password on the web page, then reinstall the app and sign in

Expected: A set-new-password page that fits the phone screen opens in the browser with no error. The new password signs in on the reinstalled app.

1. Complete a password reset
2. Open the inbox of the account's email

Expected: A confirmation email says the password was changed, with any time shown in IST, and explains what to do if the user did not make the change.

1. Open a valid reset link or pass the reset OTP
2. Type a password shorter than the configured minimum
3. Type one that misses a required character type, if the rules ask for one

Expected: The screen shows which rule is not met as the user types, and Save stays disabled. The message names the failing rule rather than a generic error.

1. Enter a valid new password
2. Enter a different value in the confirm field and tap Save

Expected: An inline error appears under the confirm field and the password is not changed.

1. On the set-new-password screen, enter the current password
2. Enter a password used before, within the configured history
3. Enter a password never used on the account

Expected: The first two are rejected with a message that the password was used recently. The last one is accepted.

1. Request a reset link
2. Wait past the configured link validity
3. Tap the link and try to set a new password

Expected: A screen or page says the link has expired and offers to send a new one. The password stays unchanged.

1. Request a reset OTP
2. Enter wrong codes until the configured attempt limit is reached
3. Enter the correct code
4. Reinstall the app and request a reset again

Expected: The correct code no longer works once the limit is reached, and the message says when to try again. Reinstalling does not reset the count before the wait ends.

1. Request a reset link and do not open it
2. Tap Resend after the configured wait and receive a second email
3. Tap the link in the first email, then the one in the second

Expected: The first link says it has been replaced by a newer one. The second link opens the set-new-password screen.

1. Use a work mailbox that scans links before delivery
2. Request a reset link and wait for the email
3. Tap the link and set a new password

Expected: The set-new-password screen opens normally, because the scanner's visit did not use up the link. The new password saves and signs in.

1. Request a reset in the phone app
2. Open the email on a laptop browser and set a new password
3. Return to the phone app and sign in

Expected: The laptop page saves the password, and the phone app's waiting screen lets the user go to sign in. The new password works on the phone.

1. Generate a long random password in a password manager
2. Paste it into the new and confirm fields and tap Save
3. Sign out and sign in by pasting the same password

Expected: The field takes the full password or shows the maximum length before saving. Signing in with the same full password works.

1. Set a new password that ends with a space
2. Reset again with a password that includes a Devanagari character
3. Sign in with each on the app and on the website

Expected: Each password is either refused by a stated rule or accepted and works the same on the app and the website. A trailing space is never dropped on one and kept on the other.

1. Lock the account with repeated wrong passwords on the login screen
2. Reset the password with a valid link
3. Sign in with the new password

Expected: The new password signs in straight away, or a message says when the lock ends. The user is never shown a generic error with no next step.

1. Pick an account created only with Sign in with Google
2. Request a password reset for its email
3. Open the email that arrives

Expected: The screen shows the usual message, and the email explains that the account uses Google sign-in or offers to set a password. No link in it leads to an error page.

1. Request a reset link
2. Force stop the app from Settings
3. Tap the link in the email

Expected: The app starts and goes straight to the set-new-password screen. It does not stop at the home, splash or login screen.

1. Enter a valid new password
2. Tap Save and turn on airplane mode at once
3. Turn airplane mode off and tap Save again

Expected: The retry either saves the password or says it was already changed, so the user knows which password to use. The new password signs in.

1. On a 3–4 GB RAM phone, open a few heavy apps
2. Request a reset OTP and switch to the messages app
3. Return to the app from the recent apps screen

Expected: The reset OTP screen reopens for the same account with the countdown intact. The code from the SMS still works.

Why a real phone: Budget phones with OEM memory managers kill apps that emulators keep alive.

1. On Xiaomi, Vivo and Samsung phones, open the reset email in the default mail app
2. Tap the link
3. Repeat with the phone maker's browser set as the default

Expected: The app opens to the set-new-password screen, or the page works inside the mail app's own browser. There is no 'page not found' and no loop between the browser and the store.

Why a real phone: Phone makers' mail apps and browsers handle app links in their own ways.

1. Install the Play Store build on an older and a recent Android version
2. Tap the reset link from the mail app on each
3. Note what opens first

Expected: The app opens straight to the set-new-password screen on both, with no app chooser and no browser page.

1. On an iPhone, open the reset email in the Mail app and tap the link
2. If the website opens instead, use the option to open it in the app
3. Repeat after once choosing to open such links in the browser

Expected: The link opens the app's set-new-password screen. If the browser was chosen earlier, the web page still works and offers a way into the app.

Why a real phone: The iOS Simulator has no Mail app, so the link must be tapped on an iPhone.

1. Clone the app with the phone's dual apps feature
2. Request a reset and tap the link in the email
3. Pick one copy in the chooser and set a new password

Expected: The reset screen opens in the chosen copy and the change applies to the account in the link. The other copy shows a signed-out state if it used the same account.

Why a real phone: App cloning is an OEM feature on Xiaomi, Samsung, Vivo and Oppo phones.

1. Install the Play Store build
2. Request a reset OTP and wait without typing

Expected: The code fills by itself on the reset screen, the same way it does on the login OTP screen.

Why a real phone: The reset SMS template must carry the app's hash, checked on a live SIM.

1. Save the old password in the phone maker's built-in password manager
2. Complete a password reset in the app
3. Sign out, then sign in with autofill

Expected: The password manager offers to update the saved password after the reset. Autofill then fills the new password, not the old one.

Why a real phone: OEM password managers and their save prompts exist only on that maker's phones.

1. Request a reset for an email that has no account
2. Request one for a registered email, then for an unregistered number
3. Compare the messages and how long each takes

Expected: Every request shows the same message, such as 'If an account exists, we have sent you a reset link', and takes about the same time. Nothing reveals whether the account exists.

1. Reset the password with a link
2. Tap the same link again from the email
3. Try to set another password

Expected: The link says it has already been used and offers to send a new one. The password set the first time still works.

1. Sign in to the account on phone B and in a web browser
2. Reset the password from phone A
3. Open the app on phone B and refresh the browser

Expected: Phone B and the browser show a signed-out state and ask for the new password. Their cached personal data is no longer shown.

1. Request reset emails or OTPs for one account again and again
2. Reinstall the app and request again
3. Check the inbox or messages for how many arrived

Expected: After the configured number of requests, the app shows a message saying when to try again. Reinstalling does not reset the limit, and no further emails or SMS arrive.

1. Sign in to account B on the phone
2. Tap a reset link sent to account A's email
3. Set a new password

Expected: The screen shows which account the link belongs to, and only account A's password changes. Account B stays signed in and unchanged, or the app asks before switching.

1. Turn on fingerprint or face unlock in the app
2. Reset the password from another phone or a browser
3. Open the app and use biometric unlock

Expected: The app asks for the new password before biometric unlock works again, or turns biometric unlock off with a message. The old session does not open on biometrics alone.

Why a real phone: Needs real fingerprint or face hardware tied to the phone's secure storage.

1. Use an account with a second sign-in step, such as an OTP
2. Reset the password with a link
3. Sign in with the new password

Expected: The second step is still asked for after the new password. The reset link alone does not open the account.

1. Turn on TalkBack on Android, then VoiceOver on a real iPhone
2. Type a new password one character at a time
3. Move focus to the rules list and the eye icon

Expected: Each rule is read with its met or not met state, and the eye icon says whether it shows or hides the password. Errors are read out when Save is tapped.

Why a real phone: VoiceOver does not run in the iOS Simulator, so a real iPhone is needed.

1. Set font size and display size to the largest in phone Settings
2. Open the set-new-password screen with the keyboard up

Expected: The rules list, fields and errors wrap without being cut off. Save can be reached without closing the keyboard.

1. Set the app language to Hindi
2. Request a reset link and open the email
3. Set a new password and trigger a rule error

Expected: The screens and rule messages show in Hindi without truncation, and the email follows the app language if the product supports it. The link in a Hindi email works the same as in English.