Passwordless sign-in

Also seen as: magic link, email link, email code, one-time code, OTP

How does passwordless sign-in work?

You give Fincanva your email address and it emails you two interchangeable ways to finish the sign-in — click the link, or type the code into the screen you are already looking at. Both are single-use and both stop working 10 minutes after the email is sent; the screen says so verbatim: "Enter the 6-digit code below, or click the link in the email. Both expire in 10 minutes."

If the email hasn't arrived, Resend code becomes available again 30 seconds after each send, and the button counts down in the meantime. On the sign-up screen the same email doubles as account creation: We sent a code to {email} — your first sign-in will create your account.

How is signing in without a password different from signing in with one?

The difference is what proves it's you — control of your inbox, or knowledge of a secret you stored yourself.

Neither route is a lesser account: the same account can use whichever is at hand on the day, and two-factor authentication applies to both. A third route, Continue with Google, hands the check to your Google account instead.

Why does Fincanva ask me to verify my email address?

Fincanva requires a verified email address before you can sign in with a password, because an unverified address may not belong to the person who typed it. A verification link goes out when you sign up, and until it is opened, a password sign-in stops with "Verify your email before signing in." and the screen switches to "Please verify your email" with a Resend verification email button. Opening the link verifies the address and signs you in.

The address matters beyond sign-in: it is the channel every passwordless link, code, reset link, and security notice travels through.

What if I forget my password, or never set one?

Use Forgot password? on the sign-in screen and Fincanva emails you a reset link, which is valid for one hour. Past that, the screen tells you plainly: "For security, password reset links expire after 1 hour." — request a fresh one and the old link stays dead.

If you created your account with Google and never had a password, the same machinery sets your first one. Fincanva shows "You signed in with Google. We'll email you a link to set a password." with a Send reset link button; open the emailed link and choose a password.

How strong does my password have to be?

A Fincanva password must be at least 8 characters long — that is the only rule the app enforces. There is no requirement for capitals, digits, or symbols.

Above that minimum the sign-up and reset-password screens show an advisory strength bar labelled Strength: {level}, where the level reads Weak, Fair, Good, or Strong. It reacts to length and to the mix of character types, and it never blocks you: a password rated Weak is accepted as long as it reaches 8 characters. Treat it as feedback, not a gate.

Defaults in Fincanva

• Passwordless is the route offered first; password sign-in and Continue with Google sit beside it.
• One email carries both the link and the code, and both expire 10 minutes after it is sent. Each can be used once.
• Resend code unlocks 30 seconds after each send.
• Password reset links expire after 1 hour.
• A verified email address is required before a password sign-in succeeds.
• Passwords must be at least 8 characters; the strength bar is advisory only.
• Changing your password from your account settings signs your other sessions out — see active sessions.

Worked example

At 09:00 you enter your email and press Continue with email →. One email lands with a Sign in button and the code 418 205.

At 09:04 you are on your laptop, where you opened the request, so you type 418205 into the code field and you are in. Had you instead opened the email on your phone, tapping the button would have signed you in there — either one works, whichever device is in your hand.

At 09:11 both are dead. Typing the code returns "That code didn't work. Try again or request a new one.", and the link lands on "This link is invalid or has expired." Pressing Resend code issues a fresh pair with its own 10-minute window; the first pair never comes back.