Passwordless Login: Email Code Instead of Accounts Nobody Remembers

For a library of professional materials, we needed a login solution for users who access a single PDF a few times a year. Such users would forget their password by the next visit and constantly go through the reset process.

How It Works

1. The user enters their email address.
2. They receive a six-digit code valid for ten minutes.
3. They enter the code on the same page and are logged in.

What We Considered

• The code is stored in the database only as a hash, so even database access does not reveal the valid code.
• The number of code entry attempts, as well as requests per email address and per IP, is limited.
• The code is valid only in the browser that requested it. Someone who sends you their code cannot use it to log you into their account.
• Accounts with page editing rights never receive a code; administrators log in with a password.

When This Is Not a Good Choice

If users log in daily, an email code becomes cumbersome. In such cases, a classic password with a password manager or logging in with a Google or Apple account is a better option.