Passwordless sign-in explained

How does passwordless sign-in work?

A team member goes to the sign-in page, enters their work email and receives a 6-digit code by email. They type the code and they are in. Clients reach the Form Menu and client portal the same way. There is no password to set when you invite someone, and none to reset.

For the step-by-step, see sign in with an email code.

What problems does it remove?

Passwords cause a predictable set of problems in small offices, and passwordless sign-in removes them:

• Reuse. People reuse passwords across sites. When another site is breached, attackers try those passwords everywhere. With no ImmiPractice password, there is nothing to reuse.
• Sharing. In busy practices, staff share one login "just for today". A code tied to a person's own mailbox discourages that.
• Sticky notes and spreadsheets. There is no password to write down at the reception desk.
• Stored password leaks. ImmiPractice stores no login passwords, so there is no password database to steal.
• Lingering access after someone leaves. A departing employee cannot keep using a password they remember. Deactivate them and disable their mailbox, and they have nothing to sign in with.
• Client friction. Clients do not create yet another account. They verify their email and continue.

What is the trade-off?

Passwordless does not make security disappear; it moves it. With email codes, the email account becomes the key. Anyone who can read a staff member's inbox can request and use a sign-in code. That means:

• A phished or weakly protected mailbox is effectively a phished ImmiPractice account.
• A mailbox left open on a shared computer is a risk.
• Forwarding rules that copy work email to a personal account also copy sign-in codes.
• If email delivery is delayed or filtered, sign-in is delayed too. See login code not received.

ImmiPractice does not currently offer an additional factor such as an authenticator app or SSO on top of the email code. We would rather say that plainly than imply otherwise.

How to make passwordless sign-in strong

1. Turn on MFA for every work mailbox. Use an authenticator app or security key at your email provider. This is the single biggest improvement you can make.
2. Use firm-controlled mailboxes. Invite staff with addresses on your firm's domain so you can disable them when someone leaves.
3. Never share codes. No one at ImmiPractice will ask for your code. Treat a request for it as phishing.
4. Report unexpected codes. A code you did not request may mean someone is trying your address. Tell your Business Admin and email sales@immipractice.com if it continues.
5. Sign out of shared machines, both ImmiPractice and the mailbox.

Is passwordless safer than passwords?

For most immigration practices, yes, provided email is protected with MFA. Weak and reused passwords are one of the most common ways small-business accounts are taken over, and email codes remove that path entirely. If your mailboxes are not protected, though, a passwordless system is only as strong as those mailboxes. The honest answer is: passwordless plus MFA-protected email is a strong combination; passwordless alone is better than weak passwords, but not a reason to skip email security.

What about client accounts?

Clients verify their email with a 6-digit code before they can submit a form or open the portal. Encourage clients to use an email address only they can read, not a shared family or agent mailbox, especially when the file includes a spouse or adult children who should see only their own information.

Related: authentication and the account security checklist.