What is user enumeration?
User enumeration is when your login, sign-up or password reset form gives different answers for emails that have an account and ones that don't, so an attacker can build a list of your real users. It's also called account enumeration.
Also called: Account enumeration
ON THIS PAGE
What it means
A message like "No account with that email" is helpful to a real person and equally helpful to an attacker. Run a list of emails through and you know exactly who has an account.
Differences can be subtle: a slower response, a different error code, or an extra step. The safest approach is to give the same answer, in the same time, every time.
Why it matters for vibe-coded apps
AI tools write helpful, specific error messages by default, which is exactly what you don't want on a login form.
- Attackers learn which emails to target with password guessing.
- Users' membership of your app can be exposed, which can be sensitive.
- It feeds phishing: attackers can send convincing emails only to your real users.
Example
A password reset form.
if (!user) return res.status(404).json({ error: "No account with that email" });
await sendResetEmail(user);
res.json({ ok: true });if (user) await sendResetEmail(user);
res.json({ message: "If that email has an account, we've sent a reset link." });Use one generic message on login, sign-up and password reset, and make sure the response time doesn't give it away.
How to check if your app has this problem
- 1Try logging in and resetting a password with an email that has no account, and then with one that does. Compare the messages.
- 2Check whether the sign-up form says "email already in use".
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Use one generic message for every outcome.
- 2Send the real details by email instead of on screen.
- 3Rate limit these forms.
- 4Keep response times similar for both cases.
Update my login, sign-up and password reset flows so they never reveal whether an email has an account. Use the same generic message and similar response time every time, and send any account-specific details by email.
Check if your app has this problem
Paste your website and we'll check for user enumeration issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
Need help?
Not sure what this means for your app? Our team will explain it in plain English.