A modern, secure, and user-friendly passwordless authentication system built with Python and Flask. This project eliminates the need for traditional passwords by implementing a "magic link" login flow, enhancing both security and user experience.
https://unseraphically-nonchalky-hermila.ngrok-free.dev/register
Traditional password-based systems are prone to various security risks, including phishing, credential stuffing, and data breaches. SecurePassless tackles this problem by allowing users to log in using a secure, one-time link sent to their email address. This approach is not only more secure but also removes the friction of remembering complex passwords.
This project was developed with a focus on clean code, security best practices, and ease of integration.
- Password-Free Login: Users sign in with their email, receiving a unique, time-sensitive magic link.
- Secure Token Generation: Utilizes cryptographically secure tokens (JWTs) for authentication links.
- Flask Backend: Built on a lightweight and powerful Python web framework.
- Responsive Frontend: A clean and simple user interface built with HTML, CSS, and vanilla JavaScript.
- Environment-Based Configuration: Easily manage secret keys and email settings using environment variables.
- Scalable Structure: Organized project structure that is easy to understand and extend.
- Backend: Python, Flask
- Frontend: HTML, CSS, JavaScript
- Database: SQLite (can be easily swapped for PostgreSQL, etc.)
- Email: SMTP (using Python's
smtplibor Flask-Mail)
Here is a recommended project structure that promotes scalability and organization.
securepassless/
├── app/ # Main application package
│ ├── models.py # Database models (e.g., User model)
│ ├── routes.py # Defines URL routes and view functions
│ ├── static/ # Static assets
│ │ ├── css/style.css
│ │ └── js/main.js
│ └── templates/ # HTML templates
│ ├── dashboard.html
│ ├── login.html
| |── register.html
| |── index.html
| |── qr_display.html
| |── qr_login.html
│
├── venv/ # Python virtual environment folder
├── .env # Environment variables for configuration
├── .gitignore # Specifies files for Git to ignore
├── config.py # Configuration file
├── requirements.txt # Project dependencies
├── app.py # Entry point to run the application
└── README.md # This file
!
Follow these instructions to get a local copy up and running for development and testing purposes.
- Python 3.8+
pippackage manager- A functioning SMTP server or an email service provider (like Gmail, SendGrid, etc.) to send magic links.
- Enter Email: The user navigates to the login page and enters their registered email address.
- Generate & Send Link: The backend validates the email, generates a secure, short-lived JSON Web Token (JWT), and emails a "magic link" containing this token to the user.
- Authenticate: The user clicks the link in their email. The application receives the request, validates the token (checking its signature and expiration), and if valid, establishes a session for the user, logging them in.
- Access Granted: The user is redirected to their dashboard or the main application page as an authenticated user.