IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Magic links & email codes (OTP)
Maya taps "email me a login link". She opens her inbox, taps the link, and she is in. There is no password to forget. But there is a catch. Her security now depends on her email account. Your goal: know when magic links fit and what risks they bring.
- A magic link is a single-use sign-in link sent by email.
- An email code works the same way, but you type it.
- Whoever owns the inbox owns the login.
- For accounts that matter, use passkeys.
What a magic link is
A magic link is a sign-in link that the app emails to you. Click it and you are logged in.
Behind it is a single-use token. This is a long string nobody can guess. It works once, and only for a short time, say ten minutes.
The app sends it to a place you control, your inbox. Getting it back proves that you control that place.
The email OTP version sends a 6-digit code instead of a link. You type the code in the tab where you started. OTP means one-time password.
A spare key left in your letterbox. Whoever opens the letterbox gets in. Many Indian apps send a login OTP by SMS instead. Then your phone number is the letterbox. See the SIM swap attack.
How the flow works
Teams like magic links because there is no password to forget, reset or leak. Setup is instant. That suits a low-risk consumer sign-up.
The honest risks
Whoever owns the inbox owns the login. A hijacked mailbox, often through a SIM swap on the recovery phone, means a hijacked account.
Magic links can also be phished. An adversary in the middle can relay the link the moment you click. See the AiTM phish.
Company link scanners open URLs before you do. They can use up a single-use link before you click. A link that sits in spam for eleven minutes is dead. Opening the link on a different device than you started on confuses users every day.
Magic link, email code or passkey?
🔗 Magic link
Click to log in. It has the least friction. But link scanners and device mix-ups hurt, and everything rides on the inbox.
🔢 Email code
You type the code, so there is no link to open on the wrong device. It also avoids link scanners. But it can still be phished and it still depends on the inbox.
🔐 Passkey
A passkey is tied to your device, so there is nothing to relay. It is phishing-resistant by design.
Where each one fits
Match the method to the stakes. For low-risk consumer accounts, a magic link or email code is a friendly default. It is also a good fallback when no passkey is set up yet.
When the account holds money, personal data or admin power, use passkeys. Keep email as a recovery path that you harden. See safe account recovery.
Go deeper: what NIST says about email
NIST SP 800-63B-4 says email must not be used as an out-of-band authenticator. Email is fine to confirm an address or to recover an account. It is not a strong sign-in method.
The AiTM relay is like the phish that beats one-time codes.
🧪 Interactive lab — enable JavaScript to play with this one.
Thinking of moving from links to phishing-resistant login? Grade your WebAuthn setup with Passkey Check. Harden the session the link hands out with Cookie Check.