Loading your workspace…

Intermediate 20 min Java Full project

Forgot Password for a SQLite Login App (Java)

Add "Forgot password?" to the SQLite login app: users answer the security question they set at sign-up, then choose a new password.

Download project ZIP View on GitHub Watch on YouTube

12.4Kviews220likes

What you'll learn

Add a security answer at sign-up
Hash answers like passwords
Reset the password only when the answer matches
Share one style across every form

Before you start

Android Studio (any recent version)
Basic Java: variables, methods and if/else
The SQLite login app from the earlier tutorial

How it fits together

1Forgot password?
2Username + security answer
3resetPassword() checks the hash
4New password saved (hashed)
5Back to login

Build it step by step

1. Start from the login app

This builds on Login and Register with SQLite. Follow that first, or download this project, which includes everything.

2. Why a security question?

A real app emails a reset link, but a phone-only SQLite app has no server to send email. Instead, users choose a secret answer when they sign up, and must give it to reset their password. Without it, anyone could reset anyone's password just by knowing a username.

3. Store the answer safely

In DatabaseHelper, add an ANSWER_HASH column. Like the password, the answer is salted and hashed, never stored as typed. Answers are trimmed and lower-cased first, so "Green " and "green" match.

4. Ask for the answer at sign-up

In activity_register.xml, show the question as text and add an answer box below it. RegisterActivity passes the answer to insertData(user, pass, answer).

5. Add the link

On the login screen, add Forgot password? above the Login button. It opens ForgotPasswordActivity and passes along any username already typed.

6. Build the reset screen

activity_forgot_password.xml has the username, the question and answer, and the new password twice. It sits in a ScrollView, so it still fits on small phones with the keyboard open.

7. Check the answer, then save

resetPassword(username, answer, newPassword) finds the user, hashes the typed answer with their salt and compares. Only if it matches does it update the password hash. Doing both in one method means the password can't change without a correct answer.

8. Don't give hints

For an unknown username or a wrong answer, show the same message. Saying "no such user" would tell an attacker which usernames exist.

9. Make the passwords match

Before saving, compare the two new password boxes and show an error on the second if they differ.

10. Run it

Register with an answer, log out, tap Forgot password?, reset it, then log in with the new password.

Tidy layouts with styles

The input boxes, titles, buttons and links each have a style in themes.xml. Every layout uses them, so changing the amber colour or text size is one edit, not twenty.

What's improved over the video

A security answer protects the reset, answers and passwords are hashed, the error never reveals which usernames exist, the new password is typed twice, and the form scrolls on small screens.

Files affected

Check what to add and what to replace before copying code.

app/src/main/java/com/example/forgotpassword/MainActivity.javaReplace file
app/src/main/res/layout/activity_forgot_password.xmlAdd these lines
app/src/main/res/layout/activity_home.xmlAdd these lines
app/src/main/res/layout/activity_main.xmlReplace file
app/src/main/res/layout/activity_register.xmlReplace file
app/src/main/AndroidManifest.xmlReplace file
app/src/main/res/values/colors.xmlAdd these lines
app/src/main/java/com/example/forgotpassword/DatabaseHelper.javaReplace file
app/src/main/java/com/example/forgotpassword/ForgotPasswordActivity.javaAdd these lines
app/src/main/java/com/example/forgotpassword/HomeActivity.javaAdd these lines
app/src/main/java/com/example/forgotpassword/RegisterActivity.javaReplace file
app/src/main/java/com/example/forgotpassword/Screens.javaAdd these lines
app/src/main/res/values/strings.xmlReplace file
app/src/main/res/values/themes.xmlReplace file

Application code

Select a file to see its code and where it belongs.

This code uses package com.example.forgotpassword. Change that first line to your own package, the one at the top of your MainActivity.

Replace fileapp/src/main/java/com/example/forgotpassword/MainActivity.java

Adds the "Forgot password?" link.

MainActivity.java

package com.example.forgotpassword;

import android.content.Intent;
import android.os.Bundle;
import android.widget.Button;
import android.widget.EditText;
import android.widget.TextView;
import android.widget.Toast;

import androidx.appcompat.app.AppCompatActivity;

/** The login screen. Opens HomeActivity when the username and password match, or the reset screen from "Forgot password?". */
public class MainActivity extends AppCompatActivity {
    EditText username, password;
    TextView signupText;
    Button loginButton;
    DatabaseHelper databaseHelper;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        Screens.setUp(this, R.layout.activity_main);

        username = findViewById(R.id.userNameText);
        password = findViewById(R.id.passwordText);
        loginButton = findViewById(R.id.loginButton);
        signupText = findViewById(R.id.textSignup);
        databaseHelper = new DatabaseHelper(this);

        signupText.setOnClickListener(v -> startActivity(new Intent(this, RegisterActivity.class)));
        // Pass on the username, so the reset screen is already half filled in.
        findViewById(R.id.textForgot).setOnClickListener(v -> startActivity(new Intent(this, ForgotPasswordActivity.class)
                .putExtra("USERNAME", username.getText().toString().trim())));

        loginButton.setOnClickListener(v -> {
            String user = username.getText().toString().trim();
            String pass = password.getText().toString();
            if (user.isEmpty() || pass.isEmpty()) {
                Toast.makeText(this, R.string.error_empty, Toast.LENGTH_SHORT).show();
                return;
            }
            String loggedInUserName = databaseHelper.checkLogin(user, pass);
            if (loggedInUserName != null) {
                Intent intent = new Intent(this, HomeActivity.class);
                intent.putExtra("USERNAME", loggedInUserName);
                startActivity(intent);
                finish();
            } else {
                Toast.makeText(this, R.string.error_login, Toast.LENGTH_SHORT).show();
            }
        });
    }
}

Full source code

Download project ZIP View on GitHub