A magic link is a one-time sign-in link sent to an account holder, usually by email or text. Instead of entering a password, the person opens the link to confirm access. The method is simple, but its security depends on how the link is created, delivered and handled.
How a magic link works
When someone requests a sign-in link, the service creates a unique web address tied to that account and sends it through a verified contact channel. Opening it tells the service that the person can access that inbox or phone, so it can start a session or finish signing in. The link generally has a limited period of validity and may work only once; the exact rules depend on the service. If it is expired or already used, the person may need to request another rather than reuse the old message.
What to check before opening one
Look at the sender and destination address, and consider whether you just requested access. A link you did not request may be a mistake or a phishing attempt, especially if the message pressures you to act or asks for unrelated personal details. Do not forward sign-in links or paste them into public chats: anyone who obtains a usable link may be able to access the account. The phrase magic links for SEO may arise in a separate discussion about search visibility; it is not a definition of passwordless sign-in.
Using the method carefully
Keep the email or messaging account used for sign-in protected with a strong, unique password and available security checks, because access to that channel can become a route into other accounts. If a message arrives unexpectedly, go to the service through a known route and check account activity instead of opening the link. For shared devices, sign out when finished and avoid saving messages that contain active sign-in links. If a link fails, request a fresh one through the service’s normal sign-in page, and review its guidance if the problem continues.