Would you offer Passwordless Login?

Magic links are convenient as an alternative form of login, when you have forgotten your password and do not "login with facebook|google|other". I wouldn't see it as the main login option.

In case you really want to focus on this idea, just be aware that specialized authentications solutions like Auth0 offer "magic link" sign-ins as part of their solution...and they have generous free tier for devs/startups.

I got really excited about passwordless for my last startup. I was offended by how insecure passwords are, and Slack had just come out...

The actual rollout was a total disaster, and we had to scramble to add password auth to the app in the days after launch.

1. Users have been trained, for better or worse, to expect a password-based system. They get really paranoid and upset if they don't get asked for a password. They think the site has been hacked, or that there's something evil going on. The problem is that low-tech users cannot be quickly educated on fundamentals; it's like telling a cultist that they are acting weird. Someone that loves them has to intervene... and that ain't gonna be you.

2. Many corporate email systems scan emails for malware, and this means following links. So it was amazing when the client agency had one of these systems in place. All of this terrible people complaining that what we'd built sucked because the login was "broken" when it was actually their mail system using their login tokens. Even the explanation didn't change their opinion. "That just means you shipped something broken." And you know what? They were right. Fuuuuuuuck.

3. Lots of old people love to forward emails they think their family would like. So they cc their account login token URL to the whole family and their teenage grandson clicks on it, steals their account. Awesome, right?

Long story short: passwordless logins are a true "this is why we can't have nice things" issue in the real world.

As a user, i dont like it and it annoys me if i always have to receive an email First Before im allowed to log in

Password-less is really useful when I didn't connect on a service for a long time, forgot my password, or didn't save it in my password manager. But if I need to connect to a service daily, I'd rather use my password manager, otherwise it adds too much friction.

It may work for very specific type of services, that helps you doing something one-shot, a yearly report for example. In this case you don't want to signup, or set a password, and it may be a very valid and friction-less workflow.

we're definitely doing it — when done well, it can be super cool.

just remember that other developers may not be your customer... all depends on how you angle.

i think it's growing though. it is growing.

To be honest, I'm really annoyed when sites use passwordless login.

My browser is configured to delete all cookies when I close it, and opening my email application is a larger hassle than using my password manager.

Apart from that, I was really confused when I used a site with passwordless login for the first time. I kept thinking: "Why is there no password?" The more sites use passwordless login, the less confusion there will be, however.

Another point to consider: Some email providers temporarily reject emails from lesser known domains, meaning that they arrive a few minutes late. This means that I cannot use the product until the email arrives. In the worst-case scenario, the link has already expired when I get the email.

That said, there will definitely people who will enjoy the ease of not having to remember a password. Hence, I might use passwordless login for a product despite disliking it myself.

For myself, I would not like this because emails are unreliable and I have a password manager. Most of the times an email arrives almost instantly but sometimes or rarely I need to wait a couple of minutes and this is really annoying. But on the other hand I am not the average user as for example I do not even have an email client on my phone. So would be interesting if this login mechanism is offered as an alternative and how many users would actually use it and if they would be more satisfied with this kind of login mechanism.

It's interesting to read all these negative reactions.

For me it all depends on how often I have to do the login. If the auth is kept around long enough I personally (as a user) have no problem with this whatsoever. In fact I despise websites that have a short session lifetime and where I have to log in every time (with a password). Even worse when they drop my shopping cart right along with it. Something I will never understand from a business perspective - but that's a different topic.

What e.g. Slack does is bonkers though. They auth per community and not per user. No whatsoever clue who thought that's this could be a good idea.

I also wish browsers would have been standardized to act as key agents - but that's yet another side track maybe worth a blog post in itself.

For me email is usually much less friction than 2FA (where we are moving towards in the general sense) as my mail is usually open anyway. I guess that's also one of the reasons e.g. Google offers 2FA through their mobile Gmail app. Only using OTP through a password manager has a slight edge.

It's not that I don't see plenty of problems with this approach.
But I am curious. What's exactly bothering you (as a user)?

So far I've distilled:

• email is too unreliable
• email is too slow
• it requires context switching

Anything else?

Thank you all for the feedback, really helpful.

I think what I've realized is that e-mail only login doesn't work for everybody in every situation (which is probably true for every auth method out there). I figured I can offer password based authentication too, and have the developer decide which methods they want to offer to their users.

By solving e-mail verification, magic e-mails, password hashing+verification and password reset I think I can make a great offering that works for most small-medium projects :).

It's a horrible user experience.

I'm on your site already. But, no, I need to go to my email app (hopefully it's delivered with no delay), open it, find the email (I literally get 100's of emails a day), open/view the email, click the button, which in turn opens a new tab (or, worse, a new browser window) in my browser (separate from the one I opened to get to your website).

All to "save me" from having having to remember a password?

I'm with @alachaum, it's a great alternative. Primary? No thank you.

I'm a user of one service that does this (which I'm mad at in general, so this probably clouds my judgment), but every time they send me the magic link to login I just think to myself, "this is intellectually lazy." As a developer I also love Firebase and am a fan of the Google Cloud ecosystem in general.

Sorry to say that I wont use it for my Watermarking website. Most of my users are very low-tech. They get confused even for a slight deviation from normal.

Honestly, not a fan.

Why would I have to go to my inbox just to log in?

It would lead to a disjointed user experience.

However, if it's an option, sure offer it. Just not as the only form of login.

I definitely think so. Google is not known for innovation/customer service. Guido, you can be known for those things =D