Why I Chose Passwordless Logins For My Projects

Seems like everything requires a password login nowadays. For my projects, I decided to do things a little differently.

Instead of creating a password, you’ll simply enter your registered email address. A few seconds later, you’ll receive a simple code or secure link in your inbox. Enter the code or click the link, and you’re signed in. That’s it.

So why did I go this route?

The biggest reason is security.

When websites use passwords, they should never store them as plain text. Instead, they run them through a mathematical process that turns them into scrambled data. This is called hashing. They also add extra random information, called a salt, to make it much harder for attackers to crack passwords if the database is ever stolen.

Done correctly, it’s very secure. But it’s also something developers have to get exactly right. There are best practices to follow, password reset systems to build, and plenty of ways to accidentally create security problems.

By using email login links instead, I never have to store your password because I never had it in the first place. There’s nothing to hash, nothing to salt, and nothing for someone to steal from my database.

Of course, this does mean your email account becomes the key to your account on my site. But for most people, their email is already (or should be) protected with a strong password and often two-factor authentication. I’d rather let companies that specialize in account security handle that part than reinvent the wheel.

It also makes life easier. No password to remember. No password to reset. Just enter your email, enter the code, or click the special link, and you’re in.

Sometimes the simplest solution is also the safest one.