I'm running in this issue for two separate accounts:

I would use the "Forgot your password?" link on login.salesforce.com to request a password reset link to be sent to my email.

However, every time I click on the password reset link in my email, I see "Your reset link expired after 24 hours or has already been used."

This has been going on for weeks and I can't help but wonder if this is a glitch on Salesforce's end. What is going on?

  • What was the solution for this? I have the same problem now. It just loops back to the same message: 'Your reset link expired after 24 hours or has already been used.'
    – jonnygold1
    Apr 8, 2017 at 9:04
  • @Regnarg Have you found any solution for this? We are also facing the same issue. May 24, 2017 at 3:59
  • @Rajendra I think what happened was that the account that I was trying to access was one that has been deactivated. I was mistakenly trying to gain access to an acccount that I was no longer given access to, if I recall correctly. May 25, 2017 at 6:07

10 Answers 10


There's a Salesforce Knowledge article about this. It is caused, as other posters have said, by the email server protection software. Salesforce lists Mimecast, McAfee's 'Link Protect' feature, Covenant Eyes and all versions of Outlook. If you go to any profile, scroll down to System and select Password Policies. In here, there is a check box you can tick to not expire the password immediately in 'forgot password' emails. This bypasses the email server protection tools, and should then allow the links to work.

Knowledge Article: https://help.salesforce.com/articleView?id=000333308&type=1&mode=1

Profile-based Password Policies

  • 1
    This is correct and should be pursued before anything else. Mar 12, 2021 at 19:04

For those who are experiencing this issue on Outlook, if the URL as presented by Outlook begins with something like https://nam02.safelinks.protection.outlook.com/?url=<escaped_sfdc_url>, then you may be able to do this, which worked for me:

  1. Copy the full URL (Careful not to accidentally click it!)

  2. In a browser developer console window, type:



  3. Delete everything in the copied URL up to (and including) url=

  4. Press Enter

This should open a new window on Salesforce where the link is not expired.

  • PS: I find that EVERYTHING about Salesforce is as hard as it can possible be. I posted the above instructions to their "Trailhead" community, and it is not possible to edit a post—or even to delete one's own post. Although their UI provides numbered lists, they are not numbered. Infuriating from start to finish.
    – Dave Land
    Mar 12, 2021 at 18:30

Is your email going through a virus scanner that checks links within emails for malware etc. ? The password reset link you are being sent expires as soon as the link is visited.

Having an admin send you a password reset link will most likely work as it uses a different format for the token and the link does not expire until the password is actually reset or 24 hours, whichever comes first.


Recently I've faced the same issue. Every time I clicked on the password reset link in my email from Outlook office, I saw

"Your reset link expired after 24 hours or has already been used.".

Once I unchecked "Try the new Outlook" checkbox, the next Salesforce reset link was valid. I have no idea what's wrong with the new style of outlook office but the issue was resolved in my case.


Raise a case. That sounds odd.

The only time I've experienced that is if I've accidentally clicked "Send new password" or whatever twice in a row for the same user.

I assume that isn't what you've been doing, so it feels like a problem at the Salesforce end.


For Mimecast you can add an exception: 1. Go to Mimecast.com administration console 2. Go to Monitoring -> URL Protection 3. Locate the password reset email. I believe if you right click on that email you can add an exception to allow future emails with links from this address to go through properly.

  • What the heck does Mimecast have to do with this?
    – Eric
    Jun 19, 2018 at 3:46
  • 1
    Mimecast is checking all email hyperlinks inside a sandbox for malicious activity. Password reset links that are designed to be clicked only once and then expire, are then no longer valid once Mimecast checks the hyperlink. Jun 20, 2018 at 17:00
  • so you are saying that all salesforce users have access to mime cast which salesforce provide and somehow can manage the reset email link
    – Eric
    Jun 20, 2018 at 23:26
  • For people that run Salesforce and an email security product such as Mimecast, Proofpoint or similar product, your email security product may be causing the issue. That's the bottom line. If you do not have an email security product, you may have an antivirus or other product that is possibly interfering with the link (by design). Jun 21, 2018 at 23:49
  • 1
    It's quite possible this is the cause. I've just stumbled upon this myself and the issue was Mimecast clicking links before I had the chance to click them. Not specifically Mimecast but any software that auto clicks email links could be the cause. I fail to see how this isn't a relevant suggestion.
    – Henders
    Aug 29, 2019 at 9:53

I was having this problem using Outlook web version on Office.com. What worked for me was getting a new link sent and then opening the email on my Android phone using the Outlook app and clicking the link from there.


I've been facing the same issue. I have opened my mail in chrome browser(not in app) and right click on reset link -> open link in new tab. This has worked for me.


https://help.salesforce.com/s/articleView?id=000332248&type=1 We had this issue in our org. Completely turning off safelinks is an obv security risk, salesforce assistance was not very helpful. With the knowledge article I linked, our infrastructure team was able to whitelist the domains where password reset links originate.

In our instance, no checkboxes fixed the issue because safelinks was touching the reset email before it arrived in the inbox.

Now we've got the same issue again because the prod env was successfully whitelisted BUT a sandbox env resides elsewhere and emails from salesforce's other IP range(s) haven't been whitelisted.

Good luck


This issue happening mostly in outlook. If you are having the same issue follow the below steps for resolution

  1. Call Salesforce toll free number and ask them to send a reset link to your registered email
  2. Open your registered email and click the link to change password
  3. If the step2 is not working then open your registered email and forward the reset link email to your personal email
  4. Now open your personal email and click the link to change your password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.