Passwordless Sign-In: Why We Send Both a Code and a Link

The part of a sign-in flow that causes the most trouble is the password. People forget it, wait for a reset email, or reuse the same password on other sites. For the service, a password is also something that has to be stored and protected against leaks.

You can now sign in to the Opus Growth dashboard without a password. When you enter your email address, we send both a six-digit code and a sign-in link to your inbox, and you can use either one to open your session. This post explains why we send both, how this approach affects security, and where to look if the email does not arrive.

Why we send both a code and a link

Systems that send only a link fail in a very common situation. If you are signing in on your computer but open the email on your phone and tap the link, the session opens in your phone's browser instead of on your computer. You end up signed in on the wrong device.

The code solves this because it does not depend on the device. You read the email on your phone, type the six-digit code on your computer, and the session opens where you wanted it. The link is faster when you sign in on the same device where you read the email, since a single tap is enough.

That is why we send both. We do not have to guess which device you are using, and both situations are covered.

How passwordless sign-in affects security

Passwordless sign-in is often assumed to be weaker, but it closes several important attack paths entirely.

• Leaked passwords are useless. A password stolen from another site cannot be used here, because your account does not have one.
• Guessing attacks do not work. The code is valid for 15 minutes and can be used only once. After five wrong attempts the code is cancelled and you need to request a new one.
• There is no password data to steal. A password that is never stored cannot surface in a leak.

In exchange, the weight of security shifts to your email account, because anyone with access to your inbox could also see the sign-in code. We therefore recommend keeping two-step verification turned on with your email provider.

The short lifetime of the code is a deliberate choice as well. A code that stayed valid for a long time would let someone who reads the email later get into the account.

If clicking the link does not sign you in

Your session is saved to the address where the sign-in link was opened, and it does not carry over to a different subdomain. So if you copy the link from the email and open it at a different address, the sign-in will not complete.

In that case, open the link exactly as it appears in the email, or enter the code by hand.

Where to look if the code does not arrive

1. Check your spam folder. On a first sign-in the email most often lands there. Once you mark it as not spam, later emails reach your inbox.
2. Check the address. Email sign-in works only for existing accounts. If the address you entered differs from the one registered on your account, no code is sent to it. If you do not have an account yet, you can sign up with Google.
3. Allow for corporate filters. Company email systems may quarantine automated messages from outside. If that happens, ask your IT team to allow them, or use another address registered on your account.

If the code arrived but has expired, simply request a new one. Sending a new code makes the old one invalid.

Frequently Asked Questions

Is passwordless sign-in secure?

Yes. Leaked passwords and guessing attacks do not work against it. In return, the security of your email account matters more, so keep two-step verification turned on there.

Why do I get both a code and a link?

The code is for people who read the email on their phone but sign in on their computer, and the link is for people who sign in on the device where they read the email. Both open the same session.

How long is the code valid?

The code is valid for 15 minutes and can be used only once. If it has expired or has been entered incorrectly five times, you need to request a new one.

I clicked the link but was not signed in. Why?

If you opened the link at an address different from the one in the email, the session does not carry over to that address. Open the link exactly as it appears in the email, or enter the code by hand.

What should I do if the email does not arrive?

First check your spam folder, then make sure the address you entered matches the one registered on your account. If you use a company email address, your company's filter may have quarantined automated messages.