Reset emails land in spam, get lost, or go to an old address — and the member gives up. Let them reset with a code texted to the phone on their account instead: blue-bubble iMessage on iPhone, SMS on Android, in seconds, for a flat ½¢.
No spam folder, no "I never got it," no outdated address. A text arrives on the phone in their hand, usually in under 5 seconds.
"I can't log in" is the #1 support request for most members areas. Self-serve reset by text takes most of them off your plate.
The code only goes to the phone already on the account, expires in minutes, and works once — so a stolen email password isn't enough to take over a member's account.
On your "Forgot password?" page the member enters their email or username, then their mobile number in the iBlueText box.
A 6-digit code arrives by iMessage (iPhone) or SMS (Android). They type it in and the box turns green.
Your site confirms the token with /siteverify, checks the verified phone matches the account, and shows "choose a new password."
Put the box inside the form, after the email/username field and before the submit button:
<form method="post" action="/reset-password">
<input name="email" type="email" autocomplete="email" placeholder="Your email">
<div class="ibt-verify" data-sitekey="ibt_site_xxx" data-theme="auto"
data-consent="By verifying you agree to receive a one-time code by text."></div>
<button type="submit">Reset password</button>
</form>
<script src="https://ibluetext.com/v.js" async></script>Then on your server, before allowing a new password:
// 1. confirm the widget token (single-use)
POST https://ibluetext.com/api/v1/siteverify
{ "secret": "ibt_secret_xxx", "token": $_POST["ibt_token"] }
→ { "success": true, "phone": "+18135550142", ... }
// 2. the one rule a reset needs:
if (success && phone == the phone saved on THIS member's account) → show "choose a new password"
else → "We couldn't verify that number for this account."⚠️ Step 2 matters: without the phone match, anyone could verify their own phone and reset someone else's password. Show the same message whether or not the email exists, so the page can't be used to discover members.
Paste this into Claude, ChatGPT or your web developer's chat:
Add "reset your password by text" to my website's forgot-password page using iBlueText SMS Verify (docs: https://ibluetext.com/docs/#verify and https://ibluetext.com/sms-password-reset). 1. Put the iBlueText widget in the forgot-password form after the email field, with my site key: [paste site key]. 2. On submit, call POST https://ibluetext.com/api/v1/siteverify with my secret key (keep it in server config, never in the page) and the ibt_token from the form. 3. Only if it succeeds AND the returned phone matches the phone saved on that member's account, show a "choose a new password" form. Otherwise show a generic "couldn't verify" message (don't reveal whether the email exists). 4. Tokens are single-use; after the password is changed, log the member in or send them to the login page.
Get your site key and secret under SMS Verify in your dashboard after you sign up free.
Member changed email or forgot their username? Find the account by the verified phone. Account recovery by SMS →
Ask for a texted code on new devices or risky logins. SMS two-factor →
Confirm by text before an email, payout or address change goes through.
Includes the iPhone/Android check and the delivered code. Prepaid, no contracts, first 10 free.
| Provider | Per code |
|---|---|
| iBlueText | $0.005 |
| Twilio Verify | ~$0.05 |
| Vonage | $0.01–0.058 |
The member enters their email or username and the phone number on their account, receives a 6-digit code by text, and types it in. Your website confirms the code with iBlueText, checks the verified phone matches the account, and then lets them choose a new password.
It proves the person has the phone on the account right now — stronger than a reset link that can sit in an inbox for days. Codes expire in minutes, work once and are rate-limited. For very high-value accounts, combine it with email or a security question.
Keep your email reset as a fallback, and use the same widget on your signup or profile page so every member adds a verified phone going forward.
The widget is two lines of HTML. The server check is a few lines — any developer, or an AI assistant using the prompt above, can add it in minutes.
More: SMS Verify overview · How to add "forgot password by SMS" · Developer docs