Magic link vs. password authentication: which is safer, compared

The built-in problems of password authentication

Password authentication is an old system that dates back to the time-sharing systems of the 1960s, and it remains the standard for digital authentication today. Yet despite its long history, password authentication has several built-in vulnerabilities.

The first problem is that it relies on human memory. If security comes first, the ideal is to use a long, random string that's different for each service, but the more accounts you use day to day, the less realistic it becomes to remember them all. As a result, people tend to drift toward reusing the same password across multiple services.

The second problem is that passwords are stored on the server. If they are properly hashed, direct leaks can be prevented, but if the database is leaked, there is a risk that the original passwords can be recovered through brute-force attacks or rainbow table attacks. Incidents where stored login credentials are leaked are reported again and again.

The third problem is vulnerability to phishing attacks. Tricking people into entering their password on a fake site that imitates a genuine login page works even without advanced technical skill. Unless users have the habit of carefully checking URLs, password authentication is inherently vulnerable to phishing.

How magic link authentication works, and how safe it is

Magic link authentication is a method that verifies your identity with a temporary link sent by email instead of a password. When a user enters an email address, the server generates a URL containing a unique token and sends it to that email address. When the user clicks the link, the token is verified and authentication is complete.

Let's look at how this method solves the 3 problems of password authentication.

The memory problem goes away. The only thing users need to remember is their email address. There's no need for a password manager either. The risk of storage on the server side also becomes smaller. A magic link token becomes invalid once it's used, and it also becomes invalid after a short expiration time. Even if the database were leaked, used or expired tokens are already invalid, so there's little room for them to be reused as they are.

Resistance to phishing also improves. With password authentication, a password entered on a fake site can be misused as is. With magic link authentication, even if you enter your email address on a fake site, the link is delivered to your genuine email address. To intercept the link, an attacker would need to break into the user's email account itself, which makes the attack far more difficult.

Weaknesses of magic link authentication, and what to do about them

Magic link authentication isn't a cure-all. In any discussion of security, it's important to be honest about weaknesses.

The biggest weakness is its reliance on your email account. If your email account is taken over, magic links reach the attacker too. This is the same risk as the "password reset email" in password authentication, but with magic link authentication, every login goes through email, so the security of your email account has a more direct effect. As a countermeasure, be sure to set up two-step verification on your email account. Major email services let you turn on two-step verification from their security settings screen, so check the settings of the service you use.

The second weakness is that logging in is no longer instant. With password authentication, you can log in within seconds, but with a magic link, you have to wait for the email to arrive. It usually arrives within a few seconds to a minute, but delays on the mail server or spam filters flagging it by mistake can hold it up. For services where you log in and out frequently, this delay can become frustrating.

The third weakness is that emails are sent in plain text. Communication between many email servers is encrypted with TLS, but encryption isn't guaranteed on every route. In theory, the risk of an email being intercepted along the way isn't zero. However, because tokens have a short expiration time and are limited to a single use, the window of time between interception and misuse is extremely limited.

Comparing convenience and user experience

Beyond security, everyday ease of use also affects which authentication method to choose.

Creating an account is lighter with magic links. Password authentication requires you to create a password (at least 8 characters, including uppercase and lowercase letters, numbers, and symbols, and so on), and you also have to enter it again to confirm. Getting an error because your password doesn't meet the requirements leads users to give up and leave. With a magic link, you just enter your email address and click the link.

Logging in has pros and cons. Password authentication, combined with your browser's autofill or a password manager, lets you log in with one click. With magic links, you have the hassle of checking your email every time. However, the reset process when you forget your password (receiving a reset link by email and setting a new password) is almost the same as the magic link login process. For users who often forget their passwords, magic links are actually smoother.

In terms of support costs, magic links have the advantage. For services that use password authentication, inquiries like "I forgot my password," "I'm locked out," and "I want to change it" make up a certain share. With magic links, these kinds of inquiries are less likely to come up in the first place.

Choosing an authentication method to fit the nature of the service

Which authentication method is better depends on the nature of the service. You can't simply say "magic links are the best."

Magic links are well suited to services you log in to infrequently. For a service like a question box, where you only log in when creating a question box or checking the dashboard, the hassle of checking your email is within an acceptable range. In fact, precisely because you only log in now and then, it's easy to forget your password, and magic links give a better experience.

Password authentication (or passkeys) is well suited to services you log in to frequently. For services you log in to many times a day, such as email clients, chat tools, and business systems, the hassle of checking your email each time adds up. For these services, integration with a password manager or passkey authentication based on FIDO2/WebAuthn is a good fit.

For services that require high security, such as financial services or medical information, a magic link alone may not be enough. It's best to combine the magic link with two-factor authentication by SMS or an app.

The choice of authentication method should be judged not by "the safest method" but by "the method best suited to the service's usage patterns and level of risk." For a casual service like a question box, magic links provide the optimal balance between security and convenience.