---
title: "Give the same answer for known and unknown · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/no-account-enumeration
updated: 2026-10-20
licence: "All rights reserved"
---

# Give the same answer for known and unknown accounts

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Abuse and limits](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits)
- Rule: Login, sign-up and password reset must answer the same way whether or not the account exists, so nobody can find out who has an account.
- How: Use one message for a wrong email and a wrong password. On reset, always give the same message. On sign-up, say "check your email" every time, and email the owner when the address is taken. Keep the response time the same too, for example by hashing a dummy password when the user is missing.
- Check: Ask for a reset for a test account and for a made-up address. The status, body and time are the same within a few milliseconds.

Example:

```text
Good:  If an account exists for this address, we sent a reset link.
Bad:   No account found for jo@example.com.
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/no-account-enumeration`.

- Previous: [Limit requests per client](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/limit-requests)
- Next: [Work out every amount on the server](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/server-side-business-rules)
- [Abuse and limits](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits)