How you should just "take the hit" (the cost is trivial) and store a randomly generated nounce in your database rather then do shenanigans like encoding user information in the url with secrets and bad cryptography and what not.
See? We listen! :)
1) user creates account (which generates nounce)
2) when password resetting via email auth via nounce.
3) when password is reset regen nounce
Is that right? Just trying to better understand what appears to be a good approach to password resets.
I got it from a quick 'password reset' search here, I recall a lot of these discussions, if you're curios click around on a few more results. :)
I was under the impression that best practice was a link with a randomly generated key that has an expiration date (and is expired as soon as it is used). The only security hole here is if the email is intercepted (and you've got other problems at that point).
the implicit (worse) alternative is that you encrypt or sign additional state in the url (and in this case, base64 was the "encryption").