Some apps no longer ask for a password at all. Instead, they email you a link, you click it, and you are in. That is a magic link login — convenient, increasingly common, and built on one big assumption about your email. Our GetMyPassword team explains what a magic link is, why services use it, and the catch worth knowing.
What a magic link is
A magic link is a passwordless login: instead of a password, the service emails you a one-time link that signs you in when you click it. The link carries a secure, single-use token and expires quickly. Enter your email, check your inbox, tap the link, and you are logged in — no password to type, remember or reset.
Why services use them
- Nothing to remember — users never create or forget a password.
- Nothing to reuse — there is no password to share across sites and leak.
- Nothing stored to steal — the service holds no password to lose in a breach.
- Less friction — signing in is a single tap from your inbox.
The catch: it all rests on your email
A magic link moves the lock from the app to your inbox. That means your account is only as secure as your email. If someone gets into your email, they can request a magic link and walk straight into every service that uses one. Your email quietly becomes the master key — which is true of password resets too, but with magic links it is the everyday way in.
A magic link does not remove the password — it moves it to your inbox. Whoever controls your email controls every account that signs you in by link, so that one account has to be your strongest.
Make your email a fortress
If magic links lean on your email, treat that account as the crown jewels. Give it a long, unique password from our password generator and turn on strong two-factor authentication — ideally an authenticator app. Be wary of unexpected login links you did not request, since a stray click can hand someone access. Secure the inbox, and every magic link behind it stays safe.
Frequently asked questions
What is a magic link login?
It is a passwordless login where, instead of a password, the service emails you a one-time link that signs you in when you click it. The link carries a secure single-use token and expires quickly, so there is no password to type or remember.
Are magic links safe?
They remove the risks of weak and reused passwords, but they make your account only as secure as your email. If your inbox is compromised, so is every service that logs you in by link, so a strongly protected email is essential.
What if I get a login link I did not request?
Do not click it. An unexpected magic link can mean someone is trying to access your account, or it is a phishing attempt. Ignore it, and if they continue, secure your email with a new password and two-factor authentication.