Passkeys, magic links, OTP: which method for what?
Signing in without a password works in several ways: passkeys, magic links, codes by email or SMS, or a code the user sends. They differ in security, in what the user needs at hand and in what happens when something goes wrong. This guide compares the methods for signing in to existing accounts and shows which fits which kind of account.
- Five methods at a glance
- Which is phishing-resistant
- Which method for which account
Christian Schätzlein, Founder and developer of Sendity
3 min read
Five ways to sign in without a password
What each needs and where it is weak
-
Passkey Fingerprint or face on the device Device
Phishing-resistant Strongest option. Needs a set-up device and a plan for losing it.
-
Magic Link Click a link in an email Inbox
Inbox needed Opens in another browser if the email is read on the phone.
-
Email code Type a code from an email Inbox
Inbox needed Works across devices, but the email can land in spam.
-
SMS code Type a code from an SMS Number
Costs per SMS Familiar, but open to SIM swap and SMS pumping.
-
Reverse OTP Send a code from your phone or inbox Message
Nothing to type One tap on send, no code to deliver. Not phishing-resistant.
Sign-ups by message. No form, no code.
Sendity is a sign-up widget for your website. Instead of filling in a form, your visitors send one short message via WhatsApp or email. Sendity checks who it came from and hands your site the name and the confirmed phone number or email address.
See how Sendity works →-
One message instead of a form Visitors tap send in WhatsApp or their email app. Nothing to type, no confirmation email to click.
-
Confirmed by the message itself The contact comes from the sender of the message, so typos and made-up addresses never reach your list.
-
Pay per confirmed contact Start with 1,000 free credits, no credit card. After that, prepaid packages with no subscription.
Four questions decide which method fits.
Passkeys
A key pair on the device, unlocked by fingerprint, face or PIN. The browser only uses it on the right domain, so a fake page gets nothing. The catch is setup and recovery when the device is lost.
Magic links and email codes
Access hangs on the inbox. Nothing to remember, but every sign-in waits for an email. Links open in the mail app’s browser, codes have to be typed.
SMS codes
Familiar to everyone and quick, but every SMS costs money, bots can trigger them, and a SIM swap moves every code to the attacker.
Reverse OTP
The page shows a code and the user sends it via WhatsApp, email or, if allowed, SMS. Nothing has to be delivered or typed. Like all codes, it is not phishing-resistant: a fake page can show a real code.
Recovery decides
An account is only as safe as its weakest way back in. Passkeys with a password reset by SMS alone are as weak as SMS.
Which method for which account?
Choose by what an attacker would gain.
Money or sensitive data
Offer passkeys, plan recovery with more than one factor, and do not rely on codes alone.
Rare sign-ins
Shop accounts, communities, event portals: a magic link or reverse OTP spares people a forgotten password.
Contact matters
If you also need a verified number or address, reverse OTP signs in and verifies the contact in one message.
Magic link or reverse OTP?
Two ways to sign in without a password, side by side.
| Aspect | Magic link | With Sendity |
|---|---|---|
| User waits for | An email | Nothing, they send |
| Device switch | Link opens in another browser | The original tab signs in |
| Spam folder | Can catch the link | Nothing to deliver |
| Phishing | Not resistant | Not resistant |
Combining works best.
No method has to stand alone.
Passkeys as an upgrade
Offer passkeys after the first sign-in instead of requiring them up front.
Two channels
Email and phone as alternatives, so one closed door does not lock people out.
Recovery with care
For valuable accounts, recovery needs a second factor or a human check.
Live on your page in minutes.
Sendity runs as a compact widget on your page. Pick the path that fits your website.
Signing in without a password: common questions.
Will passkeys replace everything else?
Not soon. Not every visitor has a passkey set up, and accounts still need a way back in when a device is lost.
Is reverse OTP a second factor?
It proves possession of a phone number or inbox. As the only factor it suits accounts with little at stake, and as a second factor alongside a password it adds possession.
What about social login?
Sign in with Google or Apple is quick, but ties your users to their accounts there. Our guide on sign-up without a password compares it in detail.
Which method has the fewest drop-offs?
The one that needs the fewest switches between apps and devices for your audience. Test it with real visitors rather than going by rules of thumb.
Keep reading.
Reviewed for accuracy in by Christian Schätzlein.
Sign in with one sent message.
Try the live demo on your phone. It takes ten seconds.