---
title: "Give the same answer for known and unknown · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/sign-in-methods/no-account-enumeration
id: ACC-79
level: Recommended
applies: accounts
updated: 2026-10-27
build: a2a6bdfed830
tokens: 868
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Give the same answer for known and unknown accounts

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Sign-in methods](https://agentwranglers.se/playbook/accounts/sign-in-methods.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: ACC-79
- Level: Recommended
- Chapter: [Sign-in methods](https://agentwranglers.se/playbook/accounts/sign-in-methods.md)
- Rule: Login, sign-up and password reset must answer the same way whether or not the account exists, so nobody can find out who has an account.
- Check: On the test copy, send 200 logins with a wrong password for a test account and 200 for a made-up address, taking turns. Do the same for resets. The status and body are identical, and the median times differ by less than 5 milliseconds. A Mann-Whitney U test finds no difference at p < 0.01.
- Applies when: The project has user accounts.
- How: Use one message for a wrong email and a wrong password. On reset, always give the same message. On sign-up, say "check your email" every time. Email the owner when the address is taken, as [prove the email address before trusting it](https://agentwranglers.se/playbook/accounts/sign-up/email-verification.md) does. Keep the response time the same too, for example by hashing a dummy password when the user is missing. Send the reset email from a background job, so the time to answer never shows whether a message went out. Limit how fast one client can ask, as [slow down password guessing](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/login-guessing.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Plain text example

```text
Good:  If an account exists for this address, we sent a reset link.
Bad:   No account found for jo@example.com.
```

## Sources

- [OWASP Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html)

## Related rules

- ACC-3 [Stop strangers from claiming an address before its owner](https://agentwranglers.se/playbook/accounts/sign-up/pre-hijacking.md) in Accounts and identity
- ACC-69 [Make sign-in and reset links single-use and short-lived](https://agentwranglers.se/playbook/accounts/sign-in-methods/sign-in-links.md) in Accounts and identity
- ACC-2 [Prove the email address before trusting it](https://agentwranglers.se/playbook/accounts/sign-up/email-verification.md) in Accounts and identity
- APS-10 [Slow down password guessing](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/login-guessing.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/accounts/sign-in-methods/no-account-enumeration">Agent Wranglers accounts and identity playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Make sign-in and reset links single-use and short-lived](https://agentwranglers.se/playbook/accounts/sign-in-methods/sign-in-links.md)
- [Sign-in methods](https://agentwranglers.se/playbook/accounts/sign-in-methods.md)