Passwordless login is an authentication method that lets a user prove identity without typing a memorized password. Instead, the system verifies possession of something the user has or controls, such as a temporary one-time code, magic link, push approval, or device-backed key. The goal is to reduce password theft, reuse, and phishing risk while making sign-in simpler for users.
In security terms, passwordless flows only work if the secret stays under server control until it is checked. If an OTP or login link is exposed in a client-visible API response, intercepted from logs, or not tied to the right session or device, the design can be turned into account takeover. Defenders should keep responses minimal, use short expiry times, bind codes to a specific request, enforce rate limits, and avoid leaking authentication data into debug output or traces. Passwordless login is convenient, but its safety depends on strict control over where the verification secret travels.