Magic Links: What They Are and How They Work

A magic link is a type of passwordless login where a link is sent to a user through email or text message after they’ve entered their email address or username into a login portal. When the user clicks on this link, they’re signed in to their account without having to enter a password. This process appears to be “magic” since the user doesn’t have to enter a password, hence the name. Magic links are also often used as a method of Multi-Factor Authentication (MFA). However, the website or app you use has to support the use of magic links. 

Continue reading to learn more about magic links, plus the advantages and disadvantages to using them.

Magic Links vs Passwords vs Passkeys: What’s the Difference?

When magic links are used instead of passwords, users don’t have to remember anything. All they need to know is the login to their email or have access to their phone and they’ll be able to sign in to their account using the magic link. When users sign in using passwords, they have to remember what their password is, type it in and then they’re granted access to their account. Unfortunately, the login experience with passwords is not always so seamless, because it can be difficult to remember the passwords for all of your accounts.

Passkeys, on the other hand, don’t require the user to log in to their email or type in a password. Depending on where a passkey was generated, to sign in with it, a user would authenticate their identity the same way they sign in to their device, which can be a passcode or biometric like FaceID. 

Are magic links secure?

When using magic links as a sign-in method, there’s no way to ensure that the person who clicks on the magic link is the person who owns or is authorized to access the account. This is because magic links can be intercepted through SIM-swapping attacks when sent through text messages. Additionally, if a user’s email account is not secured with a strong password and MFA, it can be easily compromised by a cybercriminal. Once an email account is compromised, the cybercriminal can sign in to any other accounts that use magic links.

How Magic Links Works

Here’s how a magic link works.

1. A user enters their email address or username into a login portal
2. The website or application server generates a link embedded with a token
3. The server sends the magic link to the user
4. The user receives an email or text message containing the magic lin
5. The user clicks on the magic link
6. The server checks the token
7. If the token matches, the user is authenticated and granted access to their account

Using a magic link, a user never needs to enter a password, which makes their login experience a lot easier. 

The Advantages of Using Magic Links

Here are a few advantages of using magic links.

Easier user experience

There’s no doubt that magic links make a user’s experience a lot better than having them log in with a username and password. This is because it’s often difficult for users to remember their logins for multiple accounts. Magic links also make signing into accounts a lot faster. 

No extra hardware to purchase

With magic links, there’s no need for users to purchase extra hardware to authenticate themselves. This differs from other methods of authentication like hardware security keys, which require users to purchase their own physical key to be able to authenticate their identity. 

Reduces password fatigue

Password fatigue is a phrase used to describe the feeling of exhaustion, stress and overload that people feel with their passwords. With so many accounts and rules for creating strong passwords, it can become difficult to remember them all on your own. Magic links and other passwordless authentication methods reduce password fatigue by removing the need for users to enter passwords when logging in to an account.

The Disadvantages of Using Magic Links

Here are a few disadvantages of using magic links.

Password security is tied to the email

When using magic links, the security of the magic link is tied to the security of the user’s email account. If a user’s email login credentials are weak, and MFA is not enabled, the likelihood of someone being able to compromise a user’s account with a magic link increases. 

Some websites and applications that use magic links have started to make links expire after a certain amount of time or once the user has clicked on the link to limit the chance of this from happening. 

Vulnerable to Man-in-the-Middle attacks

A Man-in-the-Middle (MITM) attack is when a cybercriminal is able to intercept the data being sent between two individuals. What makes magic links vulnerable to MITM attacks is that these links are sent through unencrypted means like emails and text messages. If a cybercriminal is able to intercept either of these, they can use the magic link to sign into the user’s account themselves. MITM attacks are more likely to happen to people who use public WiFi networks since anyone can connect to them. 

The Bottom Line

Magic links can be a great way to authenticate users without them ever having to type in a password; however, it’s important to realize that magic links also have their disadvantages. Users who have the option to sign in with magic links should ensure that their email account is secured with a strong password and has MFA enabled for added protection.

As another option, users can also check to see if passkey authentication is available for their accounts. Passkeys are a passwordless authentication method that enables users to sign in to their accounts without ever having to enter a password. Instead, all a user has to do is use their biometrics or their device’s PIN to authenticate their identity and they’re automatically signed in to their account.