pattern playground

Passwordless access

Added · Last updated

… the actor is establishing an identity or returning to sign in through account access, and memorising another secret is a burden. Instead of a password, the artifact verifies identity through an out-of-band channel (email or phone) the actor already controls.

Problem

Memorised passwords suffer from reuse, forgotten credentials, and reset fatigue. Out-of-band verification (magic links or one-time codes) removes password friction but introduces channel latency, context switching, and cross-device failure modes.

Forces

  • Magic links vs one-time codes: magic links offer one-click entry in the same browser, but break completely when the email is opened on a different device from the one requesting access (such as requesting on a laptop and opening email on a phone); one-time codes are resilient across devices but require manual typing.
  • Single input vs split segmented boxes: segmented single-digit input boxes frequently break copy-paste, mobile SMS autofill, and screen reader announcements; a single styled input handles all input modalities cleanly.
  • Security lifetime vs delivery latency: codes must expire quickly to prevent interception, but expiring too fast frustrates actors dealing with network or mail delivery delays.

Passwords require actors to invent and store secrets that modern security practices continually render obsolete. Relying on an established external channel—an email inbox or authenticator device—shifts the burden from human memory to an address the actor already controls.

Solution

Verify identity via single-use tokens or numeric codes sent out-of-band: provide a single unified code input field with numeric keypad and paste support, support cross-device transitions, state clear expiration times, and provide a direct copy button or link in the message.

Avoid separating code inputs into individual single-character fields. Use a single input styled to show code grouping, and handle spaces or hyphens gracefully on paste.

Continuation

The actor verifies their identity through an out-of-band token or code, avoiding the vulnerabilities and cognitive load of memorised passwords. Where delegated third-party authentication is preferred over communication tokens, federated identity provides an alternative…

All connections
Enables
Account access — The actor is establishing an identity or returning to sign in through account access, and memorising another secret is a burden.
Enacts
Agency — frees the actor from memorising credentials while keeping verification under their own channel control
Learnability — replaces abstract password complexity rules with the familiar physical act of checking messages
Alternatives
Federated identity — Where delegated third-party authentication is preferred over communication tokens, federated identity provides an alternative
Password — Instead of a password, the artifact verifies identity through an out-of-band channel (email or phone) the actor already controls.

In practice

Unified code input

One-time password

When sending an authentication email, include both a primary “Sign in” button (magic link) and a prominently displayed numeric code below it. If the actor clicks the link on the same device, the session resolves immediately; if they view the email on a mobile phone while signing in on a desktop computer, they can type or paste the code directly.

Clear expiry and resend cooldowns

State the code’s lifespan clearly on the input screen (e.g. “We sent a 6-digit code to name@example.com. It expires in 10 minutes”). Provide a resend button with an explicit cooldown timer (e.g. “Resend code in 45s”) to prevent rapid duplicate requests while offering an escape hatch if delivery fails.

Resources & references