Magic link

Overview

A magic link is a type of passwordless authentication. When a user enters their email address, a temporary login URL is sent to that address. When the user clicks the link, their identity is confirmed and they're logged in. Since there's no need to enter, remember, or manage a password, it has advantages for both user experience and security.

How it works

The magic link login flow is made up of 4 steps. First, the user enters their email address on the login screen. Next, the server generates a cryptographically secure random token and saves it in the database. The server then sends a URL containing this token by email. Finally, when the user clicks the link, the server checks that the token is valid and starts a session.

The token is given a short expiration time (from a few minutes to a few tens of minutes) and is designed to become invalid once it's used. This way, even if the link is forwarded to someone else, the time it could be misused is limited.

Compared with password authentication

With password authentication, the user sets and remembers a password, and the server stores its hash. This method has 3 structural weaknesses: password reuse, theft through phishing, and the risk when the database leaks.

Magic links make it easier to avoid many of these weaknesses. Since there's no password at all, reuse and leaks are unlikely to happen. The risk of typing your password into a phishing site is also small. On the other hand, there's a risk if the email account itself gets taken over, so it's a good idea to turn on two-step verification for your email account.

What kinds of services use it

Magic links are used by services that want to lower the hurdle for signing up and by services that want to avoid the cost of managing passwords. Along with passkeys based on FIDO2/WebAuthn, which use public-key cryptography, they're used as one of the options for passwordless authentication.