The One Sentence Definition
A magic link login lets you sign in by clicking a one-time link sent to your email, with no password required. You enter your email, the service emails you a unique link, you click it, and you're logged in. It's a form of passwordless authentication built entirely on your email account.
How It Works
- You type your email address on the login page.
- The service generates a unique, single-use, time-limited link and emails it to you.
- You click the link within its validity window.
- The service verifies the link is valid and unused, and logs you in.
The core idea: proving you can receive email at that address proves you're the account owner. It's essentially the "forgot password" flow turned into the primary way to log in. Behind the scenes, the link contains a random token (often carried in the URL, sometimes encoded, see our Base64 guide for how tokens travel in URLs).
Why Services Love Them
- No passwords to manage: users can't forget, reuse, or leak a password that doesn't exist. This kills credential stuffing for that service outright.
- Lower friction for signups: no password field, no "create a strong password" hurdle, which improves conversion.
- No password database to breach: nothing to steal and crack, since the service stores no passwords.
The Honest Security Trade-offs
Magic links move your security entirely onto your email account. That's a double-edged sword:
- Strength: No password to phish, reuse, or leak. For users with weak password habits, this is often a net improvement.
- Weakness: your email becomes the single point of failure. Anyone who can read your email can log into every magic-link service you use. This is why your email account deserves the strongest protection you can give it (our Gmail 2FA guide).
- Phishing risk remains: attackers can send fake "click to log in" emails, or trigger a real magic link and trick you into forwarding it. The link is a bearer token: whoever clicks it gets in.
- Friction: switching to your email app on every login annoys some users, especially on shared or locked-down devices.
Magic links don't eliminate the password problem; they relocate it to your inbox. If your email has strong 2FA, that's a good trade. If your email is weakly protected, you've put all your eggs in a fragile basket.
Magic Links vs Passkeys
Both are passwordless, but they're different:
| Magic Link | Passkey | |
|---|---|---|
| Based on | Access to your email | Cryptographic key on your device |
| Phishing resistant | No (link can be relayed) | Yes (bound to the real domain) |
| Single point of failure | Your email account | Your device/keychain |
| Convenience | Check email each login | Fingerprint/face, instant |
Passkeys are the stronger passwordless method because they can't be phished (our passkey explainer). Magic links are simpler to implement and require no special device support, which is why many services offer them. Where both are available, passkeys win on security.
Frequently Asked Questions
Are magic links more secure than passwords?
It depends on your email security. Against password reuse and weak passwords, yes, they're often safer. But they concentrate all risk on your email account, so they're only as strong as that account's protection. With strong email 2FA, magic links are reasonably secure; without it, they're fragile.
What if someone intercepts my magic link email?
Then they can log in, because the link is a bearer token. This is why the link is single-use and expires quickly (usually minutes), and why email account security is paramount. Anyone reading your inbox, via compromise or an unlocked device, can use pending magic links.
Can I use 2FA with magic links?
Some services combine them: magic link plus an additional factor. But often the magic link IS the authentication, relying on your email's own 2FA as the second layer. The strongest setup is a magic link to an email account that itself has app-based or hardware-key 2FA.
Why did I get a magic link email I didn't request?
Either someone typed your email into that service's login (harmless if you don't click), or it's a phishing attempt mimicking a magic link. Don't click magic links you didn't request, exactly as you'd ignore a password reset you didn't initiate.
Do magic links work if I'm offline?
No: you need email access to receive and click the link, which requires connectivity. This is a practical downside compared to authenticator apps or passkeys, which work offline. It's worth considering if you often log in without reliable internet.
