# magic-link

Source: https://startwithidentity.com/glossary/magic-link/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

A passwordless login where the user clicks a one-time link sent to their email. Simple to ship but inherits email security and deliverability limits, and is not phishing-resistant.

Magic links trade one credential for another: the account is now exactly as secure as the mailbox, and the mailbox is the single most attacked account a person has. They also break in ordinary ways, through link scanners that consume the token, corporate mail rewriting, and cross-device flows where the link opens in the wrong browser. Fine as a low-friction option, wrong as the only path for anything valuable.

See also: [what is passwordless](https://startwithidentity.com/guides/fundamentals/what-is-passwordless/), [passkey](https://startwithidentity.com/glossary/passkey/), [social login](https://startwithidentity.com/glossary/social-login/), [CIAM vendors](https://startwithidentity.com/vendors/ciam/)