Magic Link.

With a magic link, after the email address is entered the server generates a random, hard-to-guess token, stores it with an expiry time and sends a link containing that token by email. When the person clicks the link, the server checks whether the token exists, is still valid and has not been used, and then starts a session. The token is then invalidated. There is no password, so it cannot be forgotten, reused or stolen in another service's data breach.

The advantage is simplicity for rarely used applications: anyone who logs in to a customer portal once a month to fetch an invoice has forgotten the password anyway and ends up at 'reset password', which in practice is also a link by email. The magic link turns that detour into the standard route. For security this means: the account is exactly as well protected as the email inbox.

Magic links have typical weaknesses. The link often opens in the wrong browser: the person starts signing in on the computer but reads the mail on the phone and is then signed in on the phone. Some email security systems automatically open links in incoming mail to check them, thereby consuming a single-use token before the human clicks. And a phishing email that looks like a sign-in email is hard to distinguish from the real one. These points can be mitigated but do not disappear entirely.

A common alternative is a one-time code by email: instead of a link the person receives a six-digit code, which they enter in the same browser window. Sign-in thus stays on the device where it began, and automatic link checks do not interfere. DLM Digital uses exactly this combination in its own customer portal: sign-in by email code plus passkeys, meaning Face ID or fingerprint on your own device. Passkeys are far more resistant to phishing than any method that runs through email.