A magic link is a sign-in link sent to an email address or, in some services, a phone. Instead of entering a password, you open the link to confirm access. Knowing what the link proves—and what it does not—helps you use this method more safely.

What a magic link does

When you request a link, the service creates a special token and sends it to the contact address associated with your account. Opening the link lets the service check that the person signing in can access that inbox or message channel. The token acts like a temporary key, rather than a password you need to remember.

The process depends on how the service is built. A link may work only once, may stop working after a limited period, or may be invalidated when another link is requested. If it fails, start again from the service’s own sign-in page instead of repeatedly opening old messages. Never forward a sign-in link: another person who receives it may be able to enter your account.

Check the message before opening

The phrase magic links describes a sign-in approach, but a message that uses similar wording is not automatically genuine. Check that you recently requested access and that the sender and destination address match the service you intended to use. Be cautious if a message creates pressure, asks for unrelated personal details, or leads to a page with an unfamiliar address.

If you did not request a link, do not open it or share its contents. Someone may have entered your address by mistake, or the message may be an attempt to make you reveal a usable sign-in token. Delete it or check your account by navigating to the service yourself. If you already opened a suspicious page, avoid entering further details and use the service’s account-recovery guidance.

Protect the account around it

A magic link depends on the security of the inbox or phone receiving it. Use a distinct, hard-to-guess password for your email account, protect access to your devices, and keep recovery options current. If other people can read a shared inbox, they may also be able to use links sent there, so a private address is generally more appropriate for personal accounts.

Convenience does not remove every account risk. A compromised inbox, an unlocked device, or a link copied into a shared chat can give someone access without revealing a conventional password. Where available, review active sessions and sign out devices you do not recognise. For sensitive accounts, check the service’s own explanation of its sign-in and recovery options, and follow local rules for access and account use.