Home / Knowledge hub / Magic link
Knowledge hub
Magic link
A sign-in link sent by email that replaces the password for that visit.
What it means
A magic link is a one-time sign-in link sent to a person's email address. They enter their address, receive the message, and open the link to be signed in, with no password. The link contains a token that the server checks, then discards.
The security rests on two things: whether only the owner can read that mailbox, and whether the token is hard to guess, short-lived and usable once. If either fails, anyone with the link is that person.
Why it matters
It removes passwords, and with them password reuse and many stuffing attacks. It also makes the email account the key to your product. Anyone who controls the mailbox, or a forwarding rule on it, controls sign-in.
Implementation errors are the larger risk. A token that is predictable, never expires, can be used twice or leaks in a log turns a convenience feature into a way to take over accounts, with no password to defend.
How it shows up
You meet it as a sign-in option on newer products, in invitation emails and in passwordless checkouts. The link carries a token in the address, which can end up in browser history, proxy logs and referrer headers.
The mistakes repeat. Tokens are short or based on the time. Links stay valid for days. Mail security scanners open the link first and use it up. The link is built from the request's Host header and sent to the attacker's domain. Check lifetime, single use, binding to the requesting browser, and the reset flow beside it.
Questions people ask
Magic link, answered
Is a magic link more secure than a password?
It removes password reuse and guessing, but depends on the email account, which may be weaker than a strong password with MFA. It is a different set of risks, not a free upgrade.
Done carefully, it is a good option for many products.
How long should a magic link last?
As short as practical, often minutes, and only once. Expire it on first use and when a new link is requested. Long-lived links behave like a password sent in plain text.
OWASP's guidance on reset links applies equally here.
Why do some links fail on first click?
Email security scanners and link previews can open the link before the person does, using up a one-time token. A common fix is to show a confirmation page where a button click, not the page load, completes the sign-in.
That also helps stop accidental use.
Can we combine it with MFA?
Yes. A magic link proves access to the mailbox, and you can add a second factor for sensitive actions or for new devices. MFA also protects against a compromised mailbox.
Treat the link as one factor, not the whole answer.
What should we test?
Try reusing a link, using it after expiry, using an old one after requesting a new one, opening it in a different browser, and changing the host header on the request. Confirm each is refused.
Also check that the token is never logged.
Sources
Where this comes from
Related
Terms that sit next to this one
Passkeys
Phishing-resistant sign-in using a key on your device instead of a password.
Password reset flaw
A weak reset link or code that lets someone else take over the account.
Token
A string that stands in for an identity or a permission.
Account takeover
An attacker ends up signed in as one of your real users.
Credential recovery
The ways a locked-out user gets back in, which are often the weakest door.
Can your link be used twice?
Sign-in and recovery flows are where we look for takeover paths, and we prove each by exploiting it. Findings carry the request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.