01.02 · Concept
Passwords, OTP & Magic Links
Choose between password, emailed code and magic link for a given product, and state the attack each one is still open to.
Passwords keep the durable secret with the user, emailed codes move the proof to inbox access, and magic links turn that inbox proof into a signed URL. The right choice depends on device flow, email reliability, storage risk, phishing exposure, rate limits, and how safely temporary tokens are handled.
What this lesson answers
- password versus magic link for product login
- when to use emailed OTP instead of password
- what attacks still work against magic links
Notes
Passwords, one-time codes, and magic links are different ways to prove control of an identity. A password proves the user knows a secret. An emailed OTP proves the user currently controls an email inbox and can copy a short-lived code. A magic link proves the user controls that inbox and can open a short-lived signed login URL. All three usually depend on a server session or token after login; they mainly differ in what the user must do and what attackers must steal.
A useful mental model is to ask where the secret lives. With passwords, the user remembers or stores the secret, so your system…
References
Common questions
- Are magic links safer than passwords?
- Magic links remove password reuse and password database cracking, but they are not automatically safer. They make the user’s email inbox the main factor. If an attacker controls the mailbox, captures the link, abuses forwarding rules, or tricks the user through phishing, the login can still be compromised.
- When should I choose an emailed code over a magic link?
- Use an emailed code when the user may read email on one device but complete login on another. Copying a code adds friction, but it avoids depending on the email client opening the right browser session. It still needs short expiry, rate limits, and protection against phishing.
- What makes password login acceptable for a modern product?
- Password login is acceptable when users expect long-lived accounts, use password managers, or cannot rely on email delivery at sign-in time. The server must store only slow salted password hashes, enforce rate limits, provide safe reset flows, and assume phishing, credential stuffing, and weak passwords remain live threats.
Short definition: what is Passwords, OTP & Magic Links?