A magic link is a passwordless login method: you enter your email, the service sends a one-time link, and clicking that link signs you in. It is simple, but its security depends on the email inbox receiving the link.
Does this affect you?
Use this for any app or website that asks for an email address and then says to check your email to sign in, instead of asking you to type a password.
What happens behind a magic link
The link is the temporary credential for that one login attempt.
- You type your email address into the login screen.
- The service creates a unique link tied to that specific sign-in request.
- The link is emailed to the address you entered.
- You open the email and click the link.
- Clicking the link proves you control that inbox, so the service signs you in.
- The link usually expires quickly, often in about 10 to 15 minutes, and normally works only once.
Why services use magic links
They remove several common password problems.
- There is no password to create, remember, or reset.
- There is no weak or reused password for attackers to guess.
- A breach of the app does not expose your password because the app never stored one for you.
- Signup is faster for newsletters, simple tools, shopping flows, and other low-friction accounts.
More control
Your email becomes the security center
Anyone who controls your email inbox can request and use magic links for accounts tied to that address. Use a strong email password and two-factor authentication.
Magic links are not passkeys
A magic link depends on your email account. A passkey depends on a device-held cryptographic key unlocked with Face ID, fingerprint, PIN, or a security key.
Only click links you requested
Scammers copy this pattern. If you did not request a magic link moments ago, delete the email or go directly to the service’s website instead of clicking.
Sources
- NIST – Digital Identity Guidelines (2025)
- Google Safety Center – Passwordless sign-in options (2025)
- CISA – Choosing and protecting passwords (2025)