A magic link is a sign-in link sent to an account holder, often by email, instead of asking them to enter a password. Opening it can confirm access and create a session, depending on how the service is designed. The process is simple, but the link itself should be treated like a temporary credential.
What happens when you use one
When someone requests a magic link, the service creates a unique token and sends it to an address associated with the account. The recipient opens the message and follows the link, allowing the service to check that the token is valid before granting access. This avoids typing a password, but it does not remove the need to protect the account’s email inbox.
Links are commonly designed to work once or to expire after a limited period, though the details vary by service. A link may also be tied to the browser or device where the request began. If it has expired, been used, or is opened in an unexpected way, the sign-in may fail and a new request may be needed.
Check the message before opening it
Look at the sender and the destination shown for the link, and consider whether you requested a sign-in. An unexpected message can be a phishing attempt, especially if it pressures you to act or asks for unrelated information. A genuine login link should not require you to send someone a password, verification code, or copy of the link.
In searches, buy magic links may refer to commercial transactions; that is different from the ordinary sign-in flow, where a service generates a link for a specific account and request. A purchased or forwarded sign-in link may be unusable, misrepresented, or unsafe to share. Treat links as private, and use the service’s normal account recovery process if access is in doubt.
Use them with sensible safeguards
Keep the email account protected with a strong, unique password and any additional security options available. Avoid opening sign-in links on shared devices, and sign out when you finish if other people can use that device. If a link arrives when you did not request one, do not follow it; check account activity through the service’s usual route instead.
Magic links can make sign-in easier, but they shift some responsibility from remembering a password to securing email and recognizing authentic messages. Their privacy and recovery features differ, so check how the particular service handles expired links, suspicious requests, and account recovery. Follow local rules and use only accounts and services you are authorized to access.