Passwordless login: Magic links and account recovery

In short: Passwordless login replaces passwords with one-time links, codes or passkeys; what matters is that the recovery of the account stays secure too.

In more detail: Passwords get forgotten, reused and phished. Many services therefore offer passwordless methods. Security depends on the weakest link: often that is the route to account recovery.

In Depth

Methods

• Passkeys (FIDO2/WebAuthn): key pair in the device/password manager, confirmation by fingerprint/face/PIN. Phishing-resistant, currently the best way.
• Magic link: link by email that logs you in once and briefly valid (10 to 15 minutes). Security = security of the email account.
• One-time code by email/SMS (OTP): convenient but interceptable (SIM swapping, real-time phishing).
• Authenticator app (TOTP) or security key as second factor.
• Push confirmation (“Is this you?”).

Implementing securely (for developers)

• Magic-link tokens random (at least 128 bit), single use, short-lived, store only hashed, bind to the request (device/browser if possible).
• Rate limiting for link and code requests.
• No hints on whether an account exists (same response) to prevent account enumeration.
• Email scanners (link checkers) can open links in advance: complete login only after confirmation by click/POST.
• For codes: limit retry attempts.
• Secure the session afterwards normally (cookies HttpOnly, Secure, SameSite).

Account recovery

Recovery is the back door: whoever gains it takes over the account. Good practice: backup codes (single-use, store safely), second factor/security key, confirmed recovery email with its own protection, waiting periods and notifications (“recovery requested”), no “security questions” (answers can be guessed or researched), identity check for sensitive accounts. As a user too: register several passkeys/keys, keep backup codes offline.

Assessment

Passwordless often increases convenience and security but shifts risk to email, devices and recovery. Combine methods sensibly, offer alternatives (not every user has a compatible device) and inform understandably. A password manager remains sensible for many services.

See also: Passkeys, TOTP and WebAuthn, Rate limiting, Password manager