diff --git a/lang/en/auth.php b/lang/en/auth.php
index c73816c063c..5da36a8a7ee 100644
--- a/lang/en/auth.php
+++ b/lang/en/auth.php
@@ -38,7 +38,7 @@ $string['auth_changepasswordhelp'] = 'Change password help';
 $string['auth_changepasswordhelp_expl'] = 'Display lost password help to users who have lost their {$a} password. This will be displayed either as well as or instead of the <strong>Change Password URL</strong> or Internal Moodle password change.';
 $string['auth_changepasswordurl'] = 'Change password URL';
 $string['auth_changepasswordurl_expl'] = 'Specify the url to send users who have lost their {$a} password. Set <strong>Use standard Change Password page</strong> to <strong>No</strong>.';
-$string['auth_changingemailaddress'] = 'You have requested a change of email address, from {$a->oldemail} to {$a->newemail}. For security reasons, we are sending you an email message at the new address to confirm that it belongs to you. Your email address will be updated as soon as you open the URL sent to you in that message.';
+$string['auth_changingemailaddress'] = 'You have requested a change of email address, from {$a->oldemail} to {$a->newemail}. For security reasons, we are sending you an email message at the new address to confirm that it belongs to you. Your email address will be updated as soon as you open the URL sent to you in that message. The confirmation link will expire in <b>10 minutes</b>';
 $string['authinstructions'] = 'Leave this blank for the default login instructions to be displayed on the login page. If you want to provide custom login instructions, enter them here.';
 $string['auth_invalidnewemailkey'] = 'Error: if you are trying to confirm a change of email address, you may have made a mistake in copying the URL we sent you by email. Please copy the address and try again.';
 $string['auth_loginrecaptcha'] = 'Enable reCAPTCHA for login';
@@ -80,6 +80,7 @@ $string['emailupdatemessage'] = 'Dear {$a->fullname},
 You have requested a change of your email address for your account on {$a->site}. To confirm this change, please go to the following web address:
 
 {$a->url}
+The confirmation link will expire in <b>10 minutes</b>.
 
 {$a->supportemail}';
 $string['emailupdatesuccess'] = 'Email address of user <em>{$a->fullname}</em> was successfully updated to <em>{$a->email}</em>.';
diff --git a/user/edit.php b/user/edit.php
index 0524632a7c9..45c86df8214 100644
--- a/user/edit.php
+++ b/user/edit.php
@@ -199,9 +199,11 @@ if ($userform->is_cancelled()) {
         // Other users require a confirmation email.
         if (isset($usernew->email) and $user->email != $usernew->email && !has_capability('moodle/user:update', $systemcontext)) {
             $a = new stdClass();
-            $emailchangedkey = random_string(20);
+            // Set the key to expire in 10 minutes.
+            $validuntil = time() + 600;
+            $emailchangedkey = create_user_key('core_user/email_change', $user->id, null, null, $validuntil);
+
             set_user_preference('newemail', $usernew->email, $user->id);
-            set_user_preference('newemailkey', $emailchangedkey, $user->id);
             set_user_preference('newemailattemptsleft', 3, $user->id);
 
             $a->newemail = $emailchanged = $usernew->email;
diff --git a/user/editlib.php b/user/editlib.php
index e02ad6617cf..3b968d59566 100644
--- a/user/editlib.php
+++ b/user/editlib.php
@@ -31,8 +31,8 @@ require_once($CFG->dirroot . '/user/lib.php');
  */
 function cancel_email_update($userid) {
     unset_user_preference('newemail', $userid);
-    unset_user_preference('newemailkey', $userid);
     unset_user_preference('newemailattemptsleft', $userid);
+    delete_user_key('core_user/email_change', $userid);
 }
 
 /**
diff --git a/user/emailupdate.php b/user/emailupdate.php
index 6de500eff43..9e3da795630 100644
--- a/user/emailupdate.php
+++ b/user/emailupdate.php
@@ -44,6 +44,14 @@ $stremailupdate = get_string('emailupdate', 'auth', $a);
 
 $PAGE->set_title($stremailupdate);
 $PAGE->set_heading(format_string($SITE->fullname) . ": $stremailupdate");
+// Validate the key.
+$errormessage = get_string('auth_invalidnewemailkey', 'auth');
+try {
+    $userkey = validate_user_key($key, 'core_user/email_change', null);
+} catch (moodle_exception $e) {
+    $userkey = null;
+    $errormessage = $e->getMessage();
+}
 
 if (empty($preferences['newemailattemptsleft'])) {
     redirect("$CFG->wwwroot/user/view.php?id=$user->id");
@@ -54,7 +62,8 @@ if (empty($preferences['newemailattemptsleft'])) {
     echo $OUTPUT->header();
     echo $OUTPUT->box(get_string('auth_outofnewemailupdateattempts', 'auth'), 'center');
     echo $OUTPUT->footer();
-} else if ($key == $preferences['newemailkey']) {
+} else if ($userkey && $userkey->userid == $user->id) {
+    // Key validated, continue with email update.
     $olduser = clone($user);
     cancel_email_update($user->id);
     $user->email = $preferences['newemail'];
@@ -90,6 +99,6 @@ if (empty($preferences['newemailattemptsleft'])) {
     $preferences['newemailattemptsleft']--;
     set_user_preference('newemailattemptsleft', $preferences['newemailattemptsleft'], $user->id);
     echo $OUTPUT->header();
-    echo $OUTPUT->box(get_string('auth_invalidnewemailkey', 'auth'), 'center');
+    echo $OUTPUT->box($errormessage, 'center');
     echo $OUTPUT->footer();
 }