Is signing in to a notes app with an email link and no password safe?

Signing in with a one-time email link can be a safe way into a notes app, because there is no password to reuse, forget or have stolen in a data breach. The trade-off is that your email account becomes the key to your notes: anyone who can read your inbox can sign in. So the method is as safe as your email, which means a strong, separate email password and two-step verification on that account.

How email-link (passwordless) sign-in works

1. You type your email address on the sign-in page.
2. The app emails you a link (or sometimes a code) that works once and expires after a short time.
3. You click the link on your device and you are signed in.
4. The app keeps you signed in on that device for a while, so you do not need a new link every visit.

There is no password stored for you, so there is nothing for you to choose badly or reuse elsewhere.

Why it can be safer than a password

Passwords fail in predictable ways:

• Reuse. The NCSC notes that if you reuse a password and one account is compromised, attackers can try it on your other accounts. Its advice on securing your email starts with a strong, separate password for exactly that reason.
• Weak choices. Short or common passwords can be guessed.
• Breaches. A leaked password database exposes every user who reused that password.

With email-link sign-in, none of those apply to the notes app itself. There is no password database for the app to leak.

Where the risk moves to

The risk does not disappear; it moves to your inbox.

• If someone gets into your email, they can request a sign-in link and open your notes.
• If you click links in phishing emails, you can be tricked. A real sign-in link only arrives when you asked for one, seconds earlier.
• Shared computers are a risk if you stay signed in. Sign out when you are done.

This is why the NCSC calls two-step verification on email the most important first step: it protects your inbox even if your email password is phished.

How to make email-link sign-in safe in practice

1. Turn on two-step verification on your email account. This is the single biggest improvement.
2. Use a strong, separate password for your email, ideally stored in a password manager.
3. Only click sign-in links you just requested. If one arrives unexpectedly, ignore it; someone may have typed your address by mistake, and the link does nothing unless clicked.
4. Check the address in your browser after clicking: it should be the app's real domain.
5. Sign out on shared devices and keep your own phone and laptop locked with a PIN or password.
6. Keep the email account you use current. If you leave a job, do not sign in with a work address you will lose.

How it compares with passkeys

Passkeys are another passwordless method, built into phones, computers and password managers. The NCSC says passkeys are more secure than traditional ways to log in because they resist phishing. Email links are simpler and work on any device with access to your inbox, but they inherit your email's security. If a service offers passkeys and you are comfortable with them, they are a strong choice.

A worked example

A consultant keeps client notes in a browser-based notes app that signs in by email link. She has two-step verification on her Gmail account and a unique password saved in a password manager. On a client's office computer she signs in, prints the page she needs and signs out. A week later she gets a sign-in email she did not request; she ignores it, knowing that without access to her inbox nobody can use it.

Key takeaways

• Email-link sign-in removes reusable, guessable passwords from the notes app.
• Your email account becomes the key, so protect it first.
• Two-step verification on email is the most important step.
• Click only sign-in links you have just requested.
• Passkeys are an even more phishing-resistant passwordless option where offered.

FAQ

What if I lose access to my email?

You would not be able to request new sign-in links. Use an email address you control long term and keep its recovery options up to date.

Can someone sign in just by knowing my email address?

They can request a link, but it goes to your inbox. Without access to your email they cannot use it.

Is a magic link the same as two-factor authentication?

No. It is a single way of proving you control the inbox. Adding two-step verification to the email account gives you a second layer.

Does passwordless mean the app has no security?

No. It means the app does not rely on a password. Security still depends on the link expiring, the connection being secure and your email being protected.

Asendify Notes uses this method: sign-in is by one-time email link with no passwords, sessions stay on your device, and only the account owner can edit; you can try the free Workspace Planner to plan a layout before you sign up.

More playbooks on other topics: https://www.asendify.co/books/

More Asendify Notes articles