Passwords, OTP & Magic Links
Passwords, OTPs and magic links are login methods that prove a user controls an identity by checking either a remembered secret, a temporary emailed code, or a short-lived signed URL. They differ mainly in where the secret lives, how the user presents it, and which attacks remain possible after login.
Authentication has to answer a practical question: should this request become an account session? A password answers by testing knowledge of a secret, while email-based methods answer by testing current access to an inbox. None of these methods makes an account inherently safe. Each only moves the sensitive thing attackers try to steal, guess, forward, phish, or replay.
With passwords, the server should never keep the original text. It stores a salted, deliberately slow hash, then hashes each submitted password the same way and compares the result. With an emailed OTP, the server creates a temporary code, sends it to the address, and accepts it once under tight expiry and rate limits. With a magic link, the code is embedded in a signed login URL that creates a session when opened.
The trade-off is not simply security versus convenience. Passwords support password managers and durable accounts, but suffer from reuse, weak choices, phishing, credential stuffing, and serious damage if stored badly. OTPs remove remembered passwords but add typing friction and depend on email delivery. Magic links feel smoother, but links can be forwarded, leaked through logs or referrers, or opened on the wrong device.
Engineers meet these choices in sign-up, sign-in, account recovery, and session creation flows. Password systems need hashing, reset flows, throttling, breach defences, and careful error messages. OTP systems need code generation, expiry, replay prevention, and delivery monitoring. Magic-link systems need signed tokens, single-use handling, safe redirects, and protection against account enumeration. The honest design question is always: which remaining attack is acceptable here?
Common questions
- Are magic links more secure than passwords?
- Not automatically. Magic links remove password reuse and password database cracking, but they make the email inbox the effective authentication factor. If an attacker controls the mailbox, forwarding rules, or a device that receives the link, they can often sign in. They also require careful handling so tokens are short-lived, single-use, and not leaked.
- When should I choose an emailed OTP instead of a magic link?
- Choose an emailed OTP when users may read email on one device but need to log in on another, or when opening a link could land in the wrong browser or app context. The cost is more user effort: copying a code, handling expiry, and dealing with delivery delays or mistyped codes.
- What attack is a password login still open to if passwords are hashed correctly?
- Good hashing protects stored passwords if the database leaks, but it does not stop phishing, credential stuffing, weak reused passwords, malware, or attackers abusing the reset flow. Hashing is necessary storage hygiene, not complete authentication security. You still need rate limits, monitoring, safe errors, and a recovery design that does not become the easiest path in.