Account workflows

Helping users through CAPTCHA-gated account recovery

Provide recognition assistance and clear retries without weakening reset credentials, account factors, or the service owner’s recovery policy.

By the easycaptcha team · Published July 19, 2026

A person locked out of an account can reach recovery only to encounter an image challenge they cannot complete. If the support route also requires that challenge, the account owner may have no practical next step. Review the whole recovery task rather than only the login page.

Recovery barriers

Keep the service’s account ownership requirements unchanged. Recognition assistance can help a visitor interact with hCaptcha; it does not establish that they own the account or satisfy another authentication factor.

Make initiation and reset distinct

The operation requesting a reset message and the operation changing credentials have separate purposes and checks. Verification at initiation should not be treated as permission to reset any account. The service must validate the actual recovery credential and state according to its policy.

Preserve clear instructions without exposing whether arbitrary identifiers correspond to existing accounts. The account-enumeration guide explains why response behavior needs an independent review.

Provide a fresh-proof retry

An expired or rejected proof should lead to another verification attempt without trapping the user in a disabled-button state. Preserve appropriate non-sensitive information and do not cache account passwords or recovery secrets simply to ease retry.

For Chromium users facing hCaptcha, easycaptcha can provide recognition assistance. It does not send reset email, change a password, or make a stale recovery link current. Keep those expectations visible when support recommends an assistance option.

Offer an independent support path

Document what staff can investigate and what evidence is appropriate. A timestamp and request identifier may establish the technical failure stage without collecting full credentials. Do not ask a visitor to forward a reset secret into a general ticket unless the service has an explicit, protected workflow that requires it.

An alternative must be operationally usable: staff availability, acknowledgement, and the next permitted step all matter. A contact link alone is not proof that recovery works.

Test completed recovery

Exercise proof failure, delayed message delivery, stale recovery evidence, and successful reset followed by a normal login. Measure known recovered accounts and support-assisted completion, not only widget completion.

Password-reset controls covers protecting the service, while support-assisted completion addresses how a genuine visitor reaches a useful next step when ordinary verification remains blocked.