Key points
- Common in consumer apps and SaaS onboarding (Slack, Notion, Medium)
- Eliminates password reset friction
- Security depends entirely on the user's email account
- Vulnerable to phishing and email-account takeover
- Weaker than passkeys; useful as a stepping-stone or fallback
What it is
Magic links replace the password with a single-use, time-limited URL emailed to the user. The user clicks, the app validates the token, and the session begins.
How it works
- User enters email
- App generates a token, stores it server-side (or signs it), emails the URL
- User clicks the link within the validity window (typically 5–15 minutes)
- App validates and establishes the session
When buyers care
- B2B SaaS onboarding flows where password friction kills conversion
- Low-frequency consumer apps where users would otherwise forget passwords
- As a recovery / fallback method for passkey flows
Common misconceptions
- Magic links are not 'more secure than passwords' by default. They shift the trust to the user's email account.
- Magic links are not phishing-resistant. Passkeys are. If the threat model includes phishing, prefer passkeys.
FAQ
Should I use magic links or passkeys?
Passkeys are the long-term answer. Magic links remain useful for low-stakes flows, account recovery, and contexts where passkey UX isn't yet feasible (some embedded webviews, very low-tech audiences).
What link lifetime is appropriate?
5–15 minutes is the sweet spot. Long-lived links sitting in inboxes are an account-takeover liability.