Magic link authentication
Magic link authentication replaces a password with a single-use token delivered to an address the user already controls. The user enters their email or phone number, receives a link, and following it establishes a session. There is no stored password, so there is no password to reuse, guess, phish in the usual way, or reset.
| Risk | Magic link | Password | Password + MFA | SSO / federated |
|---|---|---|---|---|
| Credential reuse across sites | No credential to reuse | The dominant breach cause | Reduced, not removed | One credential, centrally managed |
| Phishing | Attacker must intercept the mailbox in real time | Highly effective | Push fatigue and relay attacks work | Depends on the IdP's phishing resistance |
| Compromised mailbox | Full account takeover | Full takeover via password reset | Second factor still required | Depends on IdP recovery |
| Shared household device | Session persists; link is single-use | Saved password persists | Second factor at each login | Depends on session policy |
| Support burden | No resets; user requests a new link | Password resets dominate school helpdesk volume | Resets plus factor re-enrolment | Handled centrally — if the user has an account |
| Works for a population with no district identity | Yes | Yes, badly | Enrolment is the barrier | Guardians have no district account to federate |
The properties that separate a good implementation from a bad one
- Token entropy. The token must be generated from a cryptographically secure source with enough length that guessing is infeasible. Kastr uses 32 random bytes. A six-digit numeric code, by contrast, has a million possibilities and requires strict rate limiting to be safe at all.
- Time to live. Short. Kastr expires tokens after 15 minutes. A 24-hour link sits in a mailbox that may be shared, forwarded, or synced to a device that later changes hands.
- Single use, consumed atomically. The check-and-consume must be one atomic operation. If it is a read followed by a write, two simultaneous requests can both succeed — which is not theoretical, because mail clients and security scanners prefetch links, and a naive implementation is consumed by the scanner before the parent clicks.
- Device binding. Kastr sets a cookie containing a hash of the token when the link is requested and compares it on redemption using a constant-time comparison. The effect is that a link forwarded to another device does not establish a session there.
- No account enumeration. The response is identical whether or not the address exists, and a token is issued either way. Otherwise the login form becomes a tool for confirming which families are enrolled at which school.
- Session hygiene. Kastr stores the session IP as a truncated SHA-256 hash rather than the address itself, so session records do not become a location dataset about families.
Why it fits a guardian population, and where it does not
The population a school communications platform authenticates is unusual: several thousand adults with no district-issued identity, wide variation in device and email literacy, frequently changing phone numbers, and no helpdesk that can verify them in person. Password authentication for that population produces a predictable outcome — a large share of accounts using a reused password, and a reset queue that consumes front-office time indefinitely. Requiring MFA makes enrolment the barrier rather than login, and the families least likely to complete enrolment are the families the district most needs to reach.
Two situations where passwordless-by-email is the wrong call. First, where the account holds high-value administrative capability — a district administrator who can send to every household should have a stronger factor, and the honest statement is that Kastr does not currently offer one. Second, where the user's email is itself managed by the organisation and already federated: for staff on a managed identity provider, SSO is better in every dimension, and again we do not offer it.
The gap, stated plainly
Magic link is the only authentication mechanism in Kastr. There is no SAML, no OIDC, no OAuth sign-in, no password option, and no MFA of any kind, for staff or for administrators. If your district requires federated staff identity or multi-factor authentication for tools that hold student data — a reasonable requirement, and an increasingly common one in state security frameworks — we do not meet it today.
That is a design decision for the guardian population that has been carried, so far, to the staff population as well. It is on the roadmap. It is not in the product, and it will not appear in a feature list on this site until it is.
The common misconception
"Passwordless means less secure." The comparison that matters is not magic link against a theoretically strong password, it is magic link against the password a parent actually chooses, which is frequently one they use elsewhere and which has frequently appeared in a breach corpus. Against that baseline, a single-use 15-minute token with no stored credential is a material improvement.
The genuine weakness is different and worth naming: magic link authentication delegates account security entirely to the mailbox or phone. Anyone who controls the parent's inbox controls the account. Password-based systems have the same exposure through password reset, so this is less a distinction than it appears — but it does mean that where a second factor genuinely matters, magic link alone is not enough, and adding MFA to it is the answer rather than returning to passwords.
Questions people actually ask
Are magic links less secure than passwords?
Against a strong unique password, roughly comparable and different in shape. Against the password a parent actually chooses and reuses, materially better, because there is no stored credential to breach or reuse. The real exposure is that whoever controls the mailbox controls the account — but password systems share that exposure through their reset flow.
What stops someone from reusing an intercepted magic link?
Single use plus a short expiry, and both must be enforced properly. The token is consumed atomically so a race between two requests cannot redeem it twice, and it expires 15 minutes after issue. Kastr also binds the link to the requesting device with a hashed-token cookie compared in constant time, so a forwarded link does not establish a session elsewhere.
What happens if a parent opens the link on a different device?
With device binding in place, it does not sign them in — the cookie set when the link was requested is not present. That is a deliberate trade: it defeats forwarded and intercepted links at the cost of confusing a parent who requested on a laptop and opened on a phone. The remedy is to request a fresh link from the device they want to use.
Why not just require MFA for parents?
Because enrolment becomes the barrier, and the families who fail to enrol are disproportionately the ones a district most needs to reach. There is also a plainer answer in our case: Kastr has no MFA at all, for parents or for administrators. For administrative accounts that is a genuine gap rather than a design position.
One price. Every feature. Locked for three years.
$3.50 per student per year under 5,000 students. No tiers, no add-on modules, no per-message fees. Published on the site because you should not have to book a call to learn a price.