HN Explorer

Ask HN: Why do many websites use a sign-in code instead of a password?

2 points by bariumbitmap ↗ HN
I've noticed several websites that exclusively a single-use login code for authentication. This is a 4-digit or 6-digit login code sent via email instead of a password, it's not 2FA or a passkey. (I would rather they don't do this as it means I have to open my email instead of using a password manager.) Some of them also send a magic link. Examples of websites that appear to do this exclusively (no password): substack.com, medium.com, geoguessr.com, bandsintown.com. There are also websites that default to this but will also accept passwords (e.g. spotify.com). There are also websites that will accept either a passwords or login code, but if you enter a password then they require a login code anyway (e.g. homedpot.com).

Is this becoming more common, and if so why?

6 comments

[ 12.0 ms ] story [ 115 ms ] thread
nirmeet011011
well more security,if you just need to enter your password,friends and family,someone might already know so instead they send a email.
esafak
So you don't have to remember, and they don't have to store, yet another password.
supernes
> Why do many websites use a sign-in code

> it means I have to open my email

That's the point - it's e-mail verification and user authentication in one step.

wsh
Some B2B websites require e-mail validation at each login as a way to confirm that the user’s organizational affiliation remains valid.

Being able to read mail sent to an @example.com address doesn’t prove someone is an employee of Example Co., of course, but the inability to read such mail suggests that the user’s affiliation may have ended and that access granted by virtue of it should be blocked, at least for the time being.

Single sign-on is usually a better method for this, but it’s not always practicable to set up.