Testing signup and password-reset emails

This guide is about testing the application you build and control. Use it to check your own signup and reset mail. Do not use a test inbox to work around the account verification of a third-party service — that breaks their terms and is not what DemoPost is for.

1. 1
   Register a new account with yourapp+signup@in.demopost.net in your test environment.
2. 2
   Open the confirmation message in DemoPost and read it before clicking anything: sender, subject, the account it names, and the target of the link.
3. 3
   Follow the link and confirm the application activates the right account and lands you on a sensible page.
4. 4
   Trigger a password reset for yourapp+reset@in.demopost.net and repeat the read-then-click routine.
5. 5
   Request a second reset and check what your application does with the first link.
6. 6
   Let one link sit until after its expiry window and confirm the application refuses it with a clear message.

Signup confirmation

• The message goes to the exact address used at registration, reference included.
• The account named in the message is the one you just created.
• The confirmation link points at the environment you are testing.
• Confirming twice does not produce an error page or a duplicate account.
• Re-sending the confirmation invalidates or keeps the earlier link, whichever your product intends.

Password reset

• Requesting a reset for an unknown address does not reveal whether the account exists.
• The reset link works exactly once, if that is your intended behaviour.
• An expired link produces a clear message and an obvious way to request a new one.
• Completing a reset does not sign in a different test user.
• The message contains no password and no more personal data than necessary.