When the Address Becomes the Password

Stage: sign-in without a password. In control: whoever can open your inbox.

1. The mailbox is promoted to a credential

On a service that signs you in with a link or a code sent by mail, your inbox is the password. There is no second secret anywhere in the system, and the strength of the account is exactly the strength of the mailbox it points at.

That sounds like a downgrade and often is not. A password that nobody has to invent is a password that cannot be reused from another site, cannot be weak, and cannot be phished in the usual way. For a service you visit twice a year, it removes a credential you were going to reset anyway.

What it does do is move the entire security question one step sideways. Every question about the account is now a question about the mailbox, including questions you had not planned to answer, like how long the mailbox is going to exist.

2. The token has three properties and everything follows from them

What arrives in the message, whether it looks like a long URL or a six digit number, is the same object: a token the service generated, wrote down next to your account, and is waiting to see again.

It is random enough that guessing is not a strategy. It expires, usually within minutes for codes and within the hour for links. It works once, and consuming it deletes it.

Those three properties explain the behaviour people find strange. The link is long because the randomness has to live somewhere. It stops working while you are still looking at it because the clock started when it was issued rather than when you opened the message. Requesting a second code invalidates the first, which is why the code you finally type is refused if you typed the one from the earlier message.

3. A link and a code fail in different places

The link is fewer actions when the mailbox and the browser are on the same device. Tap it and you are in.

The code survives the situation the link cannot: you are signing in on a laptop, or a television, or a device with no keyboard, and the mailbox is on your phone. A code crosses that gap by being read aloud in your head and typed. A link opens the session on whichever device opened the link, which is the wrong device, and the site on the laptop keeps waiting.

Corporate mail is the other divide. Links get rewritten by security gateways so that the address you receive belongs to the scanner rather than the service, and those rewrites sometimes break the token outright. Codes pass through untouched because there is nothing in them to rewrite.

Neither is universally better, and services that offer both are making a sensible decision rather than an indecisive one.

4. The scanner opens the link before you do

A link that reports itself as already used, on the first attempt, at a workplace, is almost always a scanner.

Mail security systems follow the links inside incoming messages to see where they lead, and they do it on arrival, before the message is shown to anyone. A single-use sign-in token cannot tell that visitor apart from you, so it does what it was designed to do: it is consumed, and it is gone.

The workaround is on the service's side, which is why the failure keeps happening: they can require a click on a landing page rather than acting on the request itself, or they can issue codes to domains where this pattern shows up. From your side, asking for a code instead of a link is the fix that works today, and if the service offers only links, a mailbox that is not behind a corporate scanner will receive one intact.

5. The expiring mailbox holds this account for exactly as long as it exists

This is where the mechanism meets a temporary address, and the arithmetic is unforgiving.

While the inbox is alive, sign-in works perfectly. The link arrives, the session opens, and the experience is smoother than a password. The guest inbox here stays alive for twenty four hours from the last time you used it and is deleted the moment you ask for a new address. A free account holds its inboxes for seven days from your last sign-in and keeps a message for up to thirty.

Once the mailbox is gone, so is the account, and there is no second path. Recovery on a link-based service means sending a link to the same address that no longer exists. There is no password to remember, no security question, and nothing for support to verify you against. The account has not been locked so much as detached from the world.

The same address may also be handed to somebody else later, since a released public address goes back into circulation, and what that means for whoever holds it next is set out in when the same address comes back.

6. The sign-in screen tells you which kind of service it is

You can usually see this coming before you register, which is the point of knowing about it.

A registration form with no password field at all is the clearest sign. So is a sign-in screen that asks for your address and then shows a continue button rather than a password box. Wording like "we will email you a link to sign in" is explicit, and a sign-in page whose only alternative is a provider button means the mailbox and the provider are the only two doors that exist.

Where you see those signs, the decision about which address to use is being made for the lifetime of the account rather than for the next five minutes.

7. The rule reduces to one line

A service that signs you in through your mailbox needs an address that will live as long as you want the account to live.

Read positively rather than as a warning, that rule is what makes a temporary address the right choice in a large number of cases: the one-off download, the forum post you will never return to, the trial you are not renewing. The account is meant to be as temporary as the address, and letting both expire together is a feature.

Where you expect to come back, the address from this page is the wrong tool, and using it is the mistake that fills support queues at services that never asked for a password.

The handover

Control here belongs to whoever can open the mailbox, which is a shorter list than it sounds if the mailbox is temporary and a longer one if it is shared. What the confirmation message proves at the moment you click it is examined in the confirmation link and what it proves, the version of passwordless sign-in that hands the job to a provider instead is signing in with an account you have, and the version that removes the message from the loop entirely is what a passkey replaces.