Signing in with a code instead of a password
Six digits by email instead of a password. It is there for people who have forgotten theirs, for people who never confirmed their address, and for people holding an expired confirmation link — and it settles all three cases at once.
Passwords get forgotten. That is the normal behaviour of someone with accounts on forty sites who uses this one once a month, and treating it as carelessness doesn't make it any rarer.
But there is a worse case, and it is the one that convinced us to build this door: somebody signs up, never finds the confirmation email — filed as spam, deleted by mistake, arrived while they were at work — and from that moment they are locked out of an account that exists. Asking for the confirmation link again often requires being signed in, and signing in requires having confirmed: a circle with no way out.
The sign-in code breaks that circle.
Where to find it
On the sign-in page, under the form, there is a line reading "Can't get in? Use a code instead". The same link appears on the page that asks you to check your inbox after signing up, and on the page you land on when a confirmation link no longer works.
How it works, step by step
- Type your email address and press Send me the code.
- A message arrives with six digits. Nothing else: no link to click, no form inside the email.
- You type them into the Enter the code page and press Sign in.
You're in. If your phone offers the digits above the keyboard by itself, that's normal: the six digits are declared as a one-time code, and recent phones can read it from the notification and suggest it to you.
The three numbers worth knowing. The code lasts five minutes. You get three attempts to type it correctly, after which that code dies and you need a new one. And you can request three every five minutes for the same address: if a fourth request is refused, wait a few minutes rather than pushing.
It verifies your address as you sign in
This is the part that settles the worst case. A code only reaches someone who genuinely has access to that inbox; typing it back proves the address is yours. So signing in this way marks the address as verified, and you never have to hunt for a confirmation link again. Anyone stuck in that circle steps out of it in one move.
If the code doesn't arrive
- Check your spam folder. First place, every time — automated email lands there more often than is reasonable.
- Check you typed the right address — the one you signed up with, which isn't necessarily the one you use today.
- Wait a minute before asking again. Two requests close together produce two codes, and only the last one works: if you try the one from the first email, it won't.
You'll notice the page answers the same way whatever address you type, including one that doesn't exist here. That isn't a fault: if it said "this address isn't registered", anyone could use that form to find out whether a particular person has an account with us. The price of not saying so is this small silence, and we pay it gladly.
Why a code and not a link to click
Plenty of sites send a link to tap: it feels more convenient, and on a computer it often is. On a phone, no. The link opens inside the mail app, which has a browser of its own; but you were signing in from the real browser, or from the icon on your home screen, and you end up logged in somewhere other than where you wanted to be. Anyone with two mailboxes on the same phone knows that small chaos well.
Six digits don't do that: you read them in the notification and type them where you already were. They are also the only form that works when you read your mail on a different device from the one you are signing in on — the office computer, the tablet at home, somebody else's phone.
Is it more or less secure than a password?
It is different, and for most people it is safer. A code lives five minutes and works once: it can't be reused, it doesn't end up in a list of stolen passwords, and it isn't the same one you used on ten other sites — which is how accounts are actually lost.
In exchange it puts all the weight on your mailbox: whoever reads your email can get in. Which makes it worth being serious precisely there — a long password used for that mailbox and nothing else, and two-step verification if your provider offers it. It is the most useful advice on this page, and it has nothing to do with us.
Your password, in any case, stays: signing in with a code doesn't delete it and doesn't replace it. It is a second door, for when the first one won't open.