Why “magic links” and passcodes are taking over news logins

I grew up in India, which is increasingly a country that runs on OTPs, or one-time passcodes. I bump into them everywhere each time I visit: When trying to connect to airport WiFi, getting into an Uber, or accessing a digital menu at a cafe. But lately, if I’m homesick, I’ve found a way of replicating that particular experience that doesn’t require getting on a flight. All I have to do is try to get the news.

If you’ve tried logging into a news site recently — especially if it’s a small outlet, like a news coop or an independent newsletter — there’s a good chance that instead of entering a password you’ve been asked to open your email inbox and find a passcode or “magic link” to sign in with. While some platforms, like Substack and Beehiiv, do offer users the option to stick to the good old username and password, others, like Ghost, offer only an email-based login.

It’s an extra step that we here at Nieman Lab have been lamenting in part because it makes sharing a single subscription among a small number of people (sorry, publishers!). It’s like Netflix’s password-sharing crackdown, but with less fanfare. But is it more convenient for publishers?

In a word, yes. 404 Media wrote about this back in 2024, after they received similar complaints from their users. 404 Media runs on Ghost, and as Ghost CEO John O’Nolan told them, “Passwords get hacked all the time, but they can’t be hacked if they don’t exist…this allows a small team like 404 to spend less time managing security administration, and more time investing in bringing you stories you care about.”

“This is really useful for small publishers who have no business wanting to store a whole bunch of random passwords,” Ernie Smith, editor of the newsletter Tedium, told me. Lots of people have poor password hygiene and reuse passwords across all kinds of sites; small publishers (and startup CMS providers) would have to invest significant time and resources to maintain security infrastructure so that they don’t get hacked and accidentally reveal personal information or a password that their customers might have used to access both the news and, say, their bank. Last December, for example, a hacker published the user data — including full names and physical addresses — of 2.3 million Wired subscribers and claimed to have the records of another 40 million subscribers from across Condé Nast. (The company did not respond to a request for comment in time for publication.)

But Smith and Tyler Denk, CEO of Beehiiv, made another case too: Magic links might actually be more convenient for users, not less. “I think it’s mostly due to password fatigue and people preferring a simple click versus having to create yet another account and password to keep track of,” Denk told me in an email. “I personally prefer magic link, as do I think many others. But obviously it’s not for everyone.”

The argument is that magic links make signing up for a news site easier for an average user who doesn’t rely on a password manager. Instead of making them come up with a new password, they can simply enter their email address and, ideally, their billing details, and continue on to the site.

Many publishers, like Condé Nast, are also moving toward passkeys, which have long been touted as the more secure replacement for passwords. Ricky Mondello, an engineer who works on authentication technologies like passkeys and passwords, argued last year that passkeys can help smooth over the rough edges of magic links so that users don’t have to keep opening their email to access sites and can have their password managers sign in for them with a passkey instead.

As for Nieman Lab’s particular predicament, of wanting to share a single subscription across the entire newsroom?

“I’m sure media outlets would love you to subscribe to the family plan,” Smith said. But he also pointed out that back in the days of print, a newsroom would just receive a single copy of a magazine or newspaper that would then be passed around to whomever wanted to read it.

“There probably just needs to be a more thoughtful discussion on how we handle this for newsrooms,” Smith continued. “Passwords are a real mess, but I’m willing to give more grace to small publishers that are using things like Ghost than I am to media conglomerates with giant buildings (and similarly large security teams) like The New York Times or Condé Nast.”