diff --git a/package.json b/package.json
index 030fdda..7848b12 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,8 @@
         "swagger-ui-express": "^5.0.1",
         "tslog": "^4.9.3",
         "typeorm": "^0.3.20",
-        "ua-parser-js": "^2.0.0"
+        "ua-parser-js": "^2.0.0",
+        "uuid": "^11.0.3"
     },
     "devDependencies": {
         "@types/bcryptjs": "^2.4.6",
diff --git a/src/controllers/auth.ts b/src/controllers/auth.ts
index 6f76ee6..719dff2 100644
--- a/src/controllers/auth.ts
+++ b/src/controllers/auth.ts
@@ -13,6 +13,7 @@ import dayjs from 'dayjs'
 import jwt from 'jsonwebtoken';
 import fs from 'fs';
 import { UserRole } from "../entity/users_roles";
+import { v4 as uuidv4 } from 'uuid';
 
 const log: Logger<ILogObj> = new Logger({ name: '[UserController]', type: 'pretty' });
 
@@ -159,13 +160,17 @@ export class AuthController {
             const param: User = await schema.validateAsync(req.params);
 
             const userRepository = OrmHelper.DB.getRepository(User);
-            const userRefreshTokenRepository = OrmHelper.DB.getRepository(UserRefreshToken);
 
             const user = await userRepository.findOne({
-                select: ['id', 'email', 'password', 'username'],
-                where: { username: param.username },
+                where: { email: param.email },
             })
 
+            user.reset_token = uuidv4();
+
+            await userRepository.save(user);
+
+            //send email reset password
+
             return ReturnHelper.successResponseAny(res, 200, Language.lang.success, {});
 
 
@@ -239,6 +244,13 @@ export class AuthController {
         /*
         #swagger.tags = ['Auth']
 
+        #swagger.parameters['token'] = {
+            in: 'path',
+            description: 'Token',
+            required: true,
+            type: 'string'
+        }
+
         #swagger.requestBody = {
             required: true,
             description: "This action will effect to user related token",
@@ -254,18 +266,18 @@ export class AuthController {
 
         try {
             const schema = Joi.object().keys({
-                id: Joi.string().uuid().required().label('ID'),
+                reset_token: Joi.string().uuid().required().label('Token'),
                 password: Joi.string().required().label('Password'),
                 retype_password: Joi.ref('password'),
             });
 
-            req.body.id = req.auth.data.id;
+            req.body.reset_token = req.params.token ?? '';
 
             const param: User = await schema.validateAsync(req.body);
 
             const userRepository = OrmHelper.DB.getRepository(User);
 
-            const data = await userRepository.findOneBy({ id: param.id });
+            const data = await userRepository.findOneBy({ reset_token: param.reset_token });
 
             if (data != null) {
                 if (param.password) {
diff --git a/src/entity/users.ts b/src/entity/users.ts
index fc7eb65..c08298e 100644
--- a/src/entity/users.ts
+++ b/src/entity/users.ts
@@ -1,5 +1,5 @@
 import bcrypt from 'bcryptjs';
-import { Entity, PrimaryGeneratedColumn, Column, CreateDateColumn, UpdateDateColumn, DeleteDateColumn } from 'typeorm';
+import { Entity, PrimaryGeneratedColumn, Column, CreateDateColumn, UpdateDateColumn, DeleteDateColumn, Index } from 'typeorm';
 
 import { Status } from '../types/status';
 
@@ -41,6 +41,13 @@ export class User {
     })
     id_role: string;
 
+    @Index()
+    @Column({
+        nullable: true,
+        type: 'uuid'
+    })
+    reset_token: string;
+
     @Column({
         nullable: false,
         length: 64