Sign-in
Sign in with a code or a link.
Your users type their address and get one email with a 6-digit code and a link that does the same. Either signs them in, in the browser that asked.
Built
Good once, for 10 minutes
Each code and link works once, for 10 minutes, and a code allows five tries. Asking again replaces both.
Bound to the sign-in that asked
A code only works in the sign-in that asked for it, so a code from one sign-in never completes another.
Safe from mail scanners
The link opens a page whose button signs in, so a scanner that fetches every link in an email spends nothing.
Stored as hashes
Codes and links are kept only as keyed hashes, so a copy of the database can’t be used to try every code.
Read next
Want it before it is finished?
Tell us what you are building and which sign-in your users need.