Developers
Designing Passwordless Login With OTP: A Safe Flow, Step by Step
Login by code removes the password, but it moves all the security onto the code and the channel that delivers it. A careful design matters more here than in a normal login form.
The flow
- The user enters an email or phone number.
- The server creates a random code and stores a hash with an expiry and an attempt counter.
- The code is sent over the chosen channel.
- The user enters the code.
- The server checks the hash, the expiry and the attempts, and then creates a session.
- The code is marked used.
Protect the request step
- Rate limit by account, IP and device.
- Return the same response whether the account exists or not.
- Add a bot check for anonymous requests.
- Cap daily sends to control cost and fraud.
Protect the verify step
- A small number of attempts, then a new code is required.
- A short lifetime.
- Constant-time comparison.
- Invalidate old codes when a new one is requested.
Choose the channel
| Channel | Strength | Weakness |
|---|---|---|
| Cheap, easy to test | Depends on the security of the mailbox | |
| SMS | Familiar to users | SIM swap, delays, cost |
| Authenticator | Strong, offline | Needs enrolment |
Session and recovery
After login, issue a normal session with its own expiry. Offer a second factor for high-risk actions. Plan recovery in advance, because a user who loses the channel is locked out.
Testing
Test with a real temporary email or a virtual number so you see real delays. Read the OTP best practices for default values.
Mistakes that break passwordless login
- Letting the code work from any browser.
- Not limiting attempts.
- Revealing which emails have accounts.
- Letting a code from an old request still work.
Monitoring
- Track the share of codes that are used.
- Track delay by channel.
- Alert on bursts of requests for one account.
Questions people ask
Is passwordless login safe?
It can be, if the code is short-lived, limited and the channel is secure.
Should I still allow passwords?
Many products offer both, with a stronger option for sensitive accounts.
Related guides and pages
Create a free OtpGet account and try it with a small balance.