If you sign up for a product with Google OAuth and have the associated email registered in the database. Then have a user that wants to login using email/password. What is an elegant way to handle that?

I have seen some services like Medium using a magic link. I think it works like this. The user signs up with Google. Email is set in the database. Then if the user wants to sign in with email a magic link that expires within 15 min is sent to the inbox. There is a token inside the link that I assume when clicked will get the user from the database and log the user in.

Is the magic link and passwordless a good UX?

What are some alternatives that are elegant?

I think another solution is to sign the user in with Google. Then have a step 2 that asks for a username and password. I have seen some services doing this. Thoughts on this approach?

The third thing I can think of is sending a generated password to the users inbox. Then if the user wants to change it he/she can in a profile view. If the user wants to access it at a later date it'll be stored in the inbox.

2 Answers 2


Hi Michael Joseph Aubry,

When evaluating approaches like this, it's best to blur the lines between usability and security.

Is the magic link and passwordless a good UX? Yes it is. The best way to create a secure UX is to make it seamless. Fingerprint, magic link e.t.c are both relatively secure and usable, they lift the cognitive burden from the user of remembering equally strong passwords (unique ones with a hard to guess characters combination)

I think another solution is to sign the user in with Google. Then have a step 2 that asks for a username and password. I have seen some services doing this. Thoughts on this approach? I do not feel quite strongly about the need for a step 2. Let's take a look at Airbnb approach.

enter image description hereenter image description here

In summary, Sending users a magic link > sending a password because they do not have to do anything with the link approach. Sometimes though, a user may not have his/her GMail on the device s/he is trying to login from e.g trying to login on an office laptop but email lives on a mobile device. So better approach may be to send a link and also provide temporary password.

  • 1
    It is reckless for a company to allow staff to signup for work-related systems using personal email and/or personal devices. Whether that is a bad thing depends on the nature of the company and the data it needs to secure (and thus any legislation or standards to which it must adhere). Catering to such a scenario is a bad move IMO. Thus, assume that the User has access to the email with which they registered whenever they are attempting to login. Sending temporary passwords via email is a bad option, seek security advice from security people not UX people.
    – straya
    Jan 20, 2020 at 5:35

I see no reason to deal with passwords if you have OAuth / magic link, you simply dont need password (and therefore dont need your user to pick password after OAuth login for sure)

Generate and send password is also not convinient: try open your inbox and find StackExchange registration email.

Every time you send magic link, it has to contain new access token, required only once to auth person (may expire in XXX minutes if not used)

Magic link makes it easy to login for new and occasional users

  • if user login say once / month, most likely he will have to reset password: to enter email, open link in email, enter new password, login with new password. Magic link is a pure pleasure compared to password recovery.

  • When user evaluate new service he will not take it serious (there is no any value yet) and pick simple password. If service happends to be useful for user, the initial password remains as the user is to lazy to chenge it. As a regular user I do the same way too :)

My invention is to use simple personal data as login for services, where security is not concern. For example I use email + mobile phone pair to authenticate athletes for running events.

  • I know they remember their emails and phones
  • Person may have 300+ facebook friends but its personal email and phone is known only by several close friends
  • at last, nothing bad will happend if someone, who know user email+phone log in. It will affect the results list, but not the result itself. So the athlete may feel confident.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.