Passwordless sign-in

Also seen as: magic link, email link, email code, one-time code, OTP

How does passwordless sign-in work?

You give Fincanva your email address and it emails you two interchangeable ways to finish the sign-in — click the link, or type the code into the screen you are already looking at. Both are single-use and both stop working 10 minutes after the email is sent; the screen says so verbatim: "Enter the 6-digit code below, or click the link in the email. Both expire in 10 minutes."

If the email hasn't arrived, Resend code becomes available again 30 seconds after each send, and the button counts down in the meantime. On the sign-up screen the same email doubles as account creation: We sent a code to {email} — your first sign-in will create your account.

How is signing in without a password different from signing in with one?

The difference is what proves it's you — control of your inbox, or knowledge of a secret you stored yourself.

Neither route is a lesser account: the same account can use whichever is at hand on the day, and two-factor authentication applies to both. A third route, Continue with Google, hands the check to your Google account instead — and it can also create the account, not only sign in to one you already have. If Google confirms your identity but you don't have a Fincanva account yet, the sign-in screen shows a consent step, headed One step to finish, asking you to accept the Terms and Privacy Policy before it creates one. The checkbox starts unticked; press the button without ticking it and nothing happens except that the box is marked with "Please accept the Terms and Privacy Policy to continue." Tick it, press Continue with Google again, and you're in — Google doesn't ask again, and there's no separate signup page and no email to open.

The emailed link and code lead to the same step. If you enter an address on the sign-in screen that has no Fincanva account yet, the email arrives exactly as it would for an existing account; only when you open its link or type its code does the sign-in screen show One step to finish, reading "This email doesn't have an account yet. Accept the Terms and Privacy Policy to create it." Check the address shown, tick the box and press Continue: the account is created and you are signed in, with no second email, because opening the link or typing the code already proved the address is yours. That proof lasts 5 minutes, stays in the browser where you used the link or code, and ends if you go back or sign in another way; if it has run out, the screen says so and Continue with email → sends one new email whose link or code creates the account. The first email's link and code are spent either way. A returning user who already has an account never sees this step, by any route.

Why does Fincanva ask me to verify my email address?

Fincanva requires a verified email address before you can sign in with a password, because an unverified address may not belong to the person who typed it. A verification link goes out when you sign up, and until it is opened, a password sign-in stops with "Verify your email before signing in." and the screen switches to "Please verify your email" with a Resend verification email button. Opening the link verifies the address and signs you in.

The address matters beyond sign-in: it is the channel every passwordless link, code, reset link, and security notice travels through.

What if I forget my password, or never set one?

Use Forgot password? on the sign-in screen and Fincanva emails you a reset link, which is valid for one hour. Past that, the screen tells you plainly: "For security, password reset links expire after 1 hour." — request a fresh one and the old link stays dead.

If you created your account with Google and never had a password, the same machinery sets your first one. Fincanva shows "You signed in with Google. We'll email you a link to set a password." with a Send reset link button; open the emailed link and choose a password.

How strong does my password have to be?

A Fincanva password must be at least 8 characters long — that is the only rule the app enforces. There is no requirement for capitals, digits, or symbols.

Above that minimum the sign-up and reset-password screens show an advisory strength bar labelled Strength: {level}, where the level reads Weak, Fair, Good, or Strong. It reacts to length and to the mix of character types, and it never blocks you: a password rated Weak is accepted as long as it reaches 8 characters. Treat it as feedback, not a gate.

How does Fincanva handle it?

• Passwordless is the route offered first; password sign-in and Continue with Google sit beside it.
• Continue with Google, the emailed link and the emailed code all create an account for a first-time visitor who started from the sign-in screen, after a one-tick consent step for the Terms and Privacy Policy (One step to finish).
• One email carries both the link and the code, and both expire 10 minutes after it is sent. Each can be used once.
• Resend code unlocks 30 seconds after each send.
• Password reset links expire after 1 hour.
• A verified email address is required before a password sign-in succeeds.
• Passwords must be at least 8 characters; the strength bar is advisory only.
• Changing your password from your account settings signs your other sessions out — see active sessions.

What does it look like in practice?

At 09:00 you enter your email and press Continue with email →. One email lands with a Sign in button and the code 418 205.

At 09:04 you are on your laptop, where you opened the request, so you type 418205 into the code field and you are in. Had you instead opened the email on your phone, tapping the button would have signed you in there — either one works, whichever device is in your hand.

At 09:11 both are dead. Typing the code returns "That code didn't work. Try again or request a new one.", and the link lands on "This link is invalid or has expired." Pressing Resend code issues a fresh pair with its own 10-minute window; the first pair never comes back.