Why passwordless magic-link login is safer

Every credential leak of the past decade has taught the same lesson: users reuse passwords across sites, and the moment any one site is breached, every reused password is at risk on every other site. The industry answer has been password managers. That works when everyone uses one. Most people don't.

Ally's answer is to remove the credential entirely. There is no password to reuse, no password to phish, no password stored in our database to leak. The only credential is temporary access to your email inbox — and if a user cannot secure their email, they cannot secure much online at all.

What magic-link actually is

At sign-in, we generate a cryptographically random token, store it hashed server-side, and email the plaintext version as a link. Clicking the link resolves the token to your account and starts a session. That is it. No password on our side, no shared secret to protect.

Where the risks are

Magic-link is not magic. Three real risks: (a) if a user's email is compromised, so is their account here; (b) corporate email scanners sometimes consume single-use tokens; (c) a determined attacker can chain a phishing email to a plausible-looking magic link. We mitigate all three: 30-minute token life, browser-fingerprint check on click, optional TOTP 2FA layered on top for accounts that want defence in depth.

Why we prefer it anyway

Because the class of threat we remove — mass credential stuffing — is by far the most common. The threat we don't fully remove — email compromise — is either the user's operational responsibility or, on Ally, mitigated by adding 2FA. On balance, users end up materially safer.

See how sign-in works step by step, or read the full security whitepaper.