The Best Self Service Password Reset Tools

Password reset requests form a large part of Help Desk call volume. Save money on your tech staff by letting users reset their passwords themselves.

Users forget their passwords all the time. No one can blame them for that – corporate password policies make this occurrence inevitable. Users are urged to not repeat passwords for different applications, resulting in them having to remember numerous unique passwords. Rules over the mix of letters, numbers, special characters, and password length requirements can make passwords impossible to get right – was it f0rGotten!974 or forg0tten974!? Get the password wrong three times and you’re locked out.

Here is our list of the best self-service password reset tools:

1. ManageEngine ADSelfService Plus – EDITOR'S CHOICE This package provides multi-factor authentication and single sign-on as well as its core function of self-service password resets for Active Directory with mobile apps for iOS and Android. Available for Windows Server, AWS, and Azure. Access a 30-day free trial.
2. N-able Passportal Blink An SSPR add-on to the cloud-based Passportal password management tool that includes confidential team credentials sharing.
3. Avatier Identity Anywhere This extensive IAM package provides a number of strategies for self-service password reset and provides a mobile app.
4. Okta This cloud-based platform is particularly well known for its SSO service and it also provides an SSPR mechanism.
5. Specops uReset This cloud-based system integrates with Active Directory to enable records to be updated according to changes made by the user.
6. FastPass SSPR This self-service password reset tool is available for Active Directory plus other ARMs and can operate for Oracle and IBM systems.

Self-service password reset tools have become real-time and money savers and they are now necessary services for all businesses. The tools are known as SSPR systems and there are a range available.

Some SSPR tools are services that are built into the identity and access management (IAM) systems and so are specific components and not generic. Others plug into widely-used access rights management (ARM) applications, such as Active Directory.

The ideal package for you depends on whether you are looking for an entirely new IAM package or if you just want to enhance the account credentials management system that you already have. We looked into a range of niches in order to cover the entire SSPR market.

The Best Self-service Password Reset Tools

Most of the tools we discovered are cloud-based but we did manage to find a couple that you can host yourself.

1. ManageEngine ADSelfService Plus – FREE TRIAL

ManageEngine ADSelfService Plus provides a library of plug-ins to applications so it can go in and update the passwords that users of its self-service interface change. One of those applications is Active Directory, so that lets your users update their facilities access passwords as well.

Key Features:

• Updates a list of applications: Provides a library of integrations
• Interfaces to Active Directory: Updates passwords in AD and Entra ID
• Multi-factor authentication: Includes a mobile app for identity verification
• Single sign-on: Will synch credentials to those applications in the integrations library
• Enforces password policy: Integrate your corporate policy into the SSPR app

Why do we recommend it?

ManageEngine ADSelfService Plus includes a Web-based interface for users to access and change their passwords and also offers the option of a mobile app, which provides a 2FA mechanism to prove identity. The system implements a single sign-on environment, removing the need for users to keep logging in.

I found that as well as providing a mobile app for an authentication option, the ADSelfService Plus package offers 20 mechanisms to allow users to prove their identities as part of a 2FA strategy. These include biometrics. Secondary and irrefutable proof of identity is essential to creating a secure SSPR system because it removes the opportunities for outsiders to trick their way through credentials theft.

The administrator console provides a flexible and easy-to-follow guide to setting up a secure SSPR system for a long list of applications. The user’s location can also be checked for extra security. A single sign-on service allows passwordless access to systems and these functions will be applied to both on-premises resources and cloud-based assets.

Who is it recommended for?

This package is essential for any business. It is able to manage user credentials in Active Directory and many other applications, including cloud services. ManageEngine provides a free edition for small businesses – it is limited to 50 users. Endpoint MFA is available as an add-on and it provides extra levels of security to computers running Windows, macOS, or Linux.

ManageEngine ADSelfService Plus is available as a software package for Windows Server and it is also offered as a service on AWS and Azure. You can examine the package with a 30-day free trial.

2. N-able Passportal Blink

N-able Passportal is a cloud-based password sharing system for support teams. It is able to distribute credentials without the user being able to see them and, as passwords don’t need to be remembered, it will generate complex passwords. In this context, it is difficult to see how Passportal could have a self-service module. It does, but that unit, which is called Blink, is intended for use by end users rather than the technical teams who use the main service of the package.

Key Features:

• A shared password manager: Suitable for use by support teams
• Self-service password reset: For user communities
• Document vault: An additional file security service
• Protection for hybrid systems: Manage passwords for on-premises resources, cloud systems, and client  company devices

Why do we recommend it?

N-able Passportal Blink extends the password vault service of the main Passportal package to manage end user passwords, enabling users to change their credentials and avoid having to call the Help Desk. The system also maintains a secure space to hold secrets, such as keys, and sensitive documents.

I noted that Passportal interfaces with Active Directory and other LDAP-based access rights managers to ensure that the password updates implemented through Passportal Blink get implemented in the ARM. The Blink system is exclusively based on Active Directory and it will manage the passwords for Microsoft products, such as Windows and Microsoft 365.

Who is it recommended for?

The Passportal system is a product of N-able, which is a brand of products that are designed for use by managed service providers. The system has a multi-tenant architecture to keep the data of clients separate. However, IT departments can use the system to manage the passwords within a company simply by not implementing sub-accounts.

You can try out both Passportal and the Blink add-on by accessing a 30-day free trial.

3. Avatier Identity Anywhere

Avatier Identity Anywhere is a Docker-based identity and access management (IAM) service that controls access to on-premises systems and cloud resources. The Password Management unit in the platform provides password reset capabilities for technicians and for users. The SSPR service allows administrators to set up a strategy from a range of options. In one of these, requesting users prove their identities by answering questions. These questions and their answers are defined by the user during the onboarding process.

Key Features:

• Question-based identity challenges: Lets the users prove their identities
• Mobile device option: Send a reset code to a registered phone
• Coordinates to Active Directory: Synchs enterprise access rights managers

Why do we recommend it?

Avatier Identity Anywhere is a hosted platform that operates through Docker containers. That delivery system ensures security and blocks any attack strategy that hackers might use. Other reset options in the package include a technician-commanded mass password reset for inactive accounts. The system includes guided onboarding processes that set up options for password resets further along in the lifecycle of the credentials.

I learned that the Avatier platform has many modules and the SSPR is just one of the tools in the package. It also provides password reset tools for use by technicians. The platform includes a number of options to enable users to identify themselves during a password reset request. One of these is through a series of questions and the other is by sending a reset code to a mobile device. Avatier also provides a mobile app with a menu of password-related functions. That app is available for iOS and Android.

Who is it recommended for?

This is a SaaS platform that offers an entire IAM system rather than just an SSPR tool. It isn’t possible to sign up to just the self-service password reset system. The full system is probably more suitable for large organizations than SMEs, although the charge rate for the package is based on the number of users in the enterprise.

The Avatier platform includes a range of credentials management tools and you can try them all by accessing a 14-day free trial.

4. Okta

Okta offers two account management packages – Customer Identity Cloud and Workforce Identity Cloud. Both systems provide the same SSPR mechanism, which lets users set their own passwords without the intervention of support technicians. The self-service reset function is built into the login screen for Okta-protected systems on a Settings menu.

Key Features:

• Integrated SSPR: Built into login screens
• Protection for all user accounts: Systems for customers and employees
• Password policy enforcement: SSPR integrates with password policies

Why do we recommend it?

Okta is particularly acclaimed for its single sign-on environment, and that is the platform’s main selling point. The SSPR isn’t considered by Okta as a notable feature – it is just part of the package that is explained on the admin guide, but not highlighted on the sales pages of the Okta website.

I discovered that the SSPR function in Okta requires a number for a mobile device to be recorded on the user’s record. When the user selects Forgot Password from the Settings menu on a login screen, the Okta system shows a reset facility and sends a reset code via SMS. The user enters the code in the screen to get to the password setting function.

Who is it recommended for?

Buyers of Okta will be looking for a way to manage user accounts on a website or workforce accounts within the business. Those employee accounts could give access to on-premises systems and cloud-based services. Okta will create a single sign-on service for each user. The self-service password reset function is built into both packages.

Okta offers a 30-day free trial of both the Customer Identity Cloud and the Workforce Identity Cloud platforms.

5. Specops uReset

Specops uReset provides a system that lets users set up their own passwords on new accounts and unlock existing accounts by providing a new password. This system integrates with Active Directory to update user account records and will also update locally cached passwords. The full Specops platform also implements multi-factor authentication and location-dependent access permissions.

Key Features:

• Interfaces with Active Directory: Involved with the initial setup of accounts as well as providing an SSPR
• Coordinates with local stores: Updates local caches as well as the central access rights manager
• Integrates with login screens: A new link in a login screen leads to the Specops password reset buttons

Why do we recommend it?

Specops uReset tags login screens with a link through to its own reset window. This can be used to get users to set up a password on a new account. It is also available for those who have been locked out by getting the password wrong too many times or just can’t remember the password.

I observed that the Specops system is closely linked to Active Directory, which means that it isn't of any use for companies that use other access rights management tools or have a lot of Linux computers. The platform includes a library of integrations to the most widely-used applications, which enables the password reset link to appear on the login screens for those systems.

Who is it recommended for?

This is a good option for any type or size of company. It is used with Active Directory, so that system is a requirement for the use of uReset. The service is able to integrate with cloud-based applications as well as those that are hosted on-premises. The entire Specops system is a cloud platform, so you don’t need to host the SSPR on your own server.

You can run uReset through its paces by accessing a 30-day free trial.

6. FastPass SSPR

Like most SSPR systems, this FastPass service integrates with Active Directory and Entra ID (Azure AD) to provide a reset function for Windows and other Microsoft products. However, the FastPass system has integrations with a great many other applications and some of those aren’t catered for by the other tools on this list. These include the Oracle and SAP ERP systems.

Key Features:

• Active Directory account resets: For system resources and Microsoft products
• Resets for ERPs: Including Oracle and SAP
• IBM mainframe compatibility: Works for accounts on IBM z Series z/OS

Why do we recommend it?

FastPass SSPR is provided by a long-running and highly respected IAM brand. The self-service password reset system is able to manage accounts for many systems that other SSPRs just can’t reach. The tool is particularly unique in its availability for accounts on IBM z/OS mainframes.

I noticed that FastPass doesn’t just let anyone reset an account password; the user has to go through an authentication check and the platform provides access to third-party authenticators for that purpose. This is particularly important because FastPass SSPR specializes in allowing remote users to reset account passwords.

Who is it recommended for?

FastPass is priced per user with a lower rate for large numbers of accounts. This makes the package affordable for any size of business and an even better deal for very big organizations. Companies that run z Series mainframes will be particularly interested in this service because they have very few options for SSPR on that platform.

FastPass is a SaaS platform and it is also available for download to run on Windows Server. You can examine FastPass SSPR by accessing a demo.