Plans · July 23, 2026

Why no password

Passwords have two fundamental problems: you forget them or you reuse them. Forgot it: recovery process. Reused it: if another site leaks, your account here is compromised.

Magic-link eliminates these problems. No password to forget or leak. Access is proved by control of your email inbox, which is already protected by its own authentication.

How it works

1. You enter your email in CleverNote
2. The system generates a cryptographically secure, single-use token
3. An email is sent with the link
4. You click the link, the token is validated and invalidated simultaneously
5. Your session begins

The token expires in 15 minutes if unused. The session lasts 30 days.

Token security

Internally, the token is stored as a hash (not plain text). Even if the database were compromised, previous tokens wouldn’t be usable.

Each token only works once: when clicked, it’s immediately invalidated. Phishing links that try to use the token after you’ve already clicked don’t work.

Sessions and devices

The session is stored as an HttpOnly cookie (not accessible to JavaScript) with HMAC-SHA256 signing. It is not recorded in a database: it is a self-verifying cookie, with no server-side state.

That is why there is no panel listing your devices. Logging out ends the session on that device, and every session expires on its own after 30 days. If you suspect unauthorized access, the practical step is to log out.

Rate limiting

The system applies a limit of 5 login attempts per minute per IP. This prevents email enumeration attacks or spam login attempts.

Tip: add CleverNote email to contacts

Magic-link emails come from notify@clevernote.net. Adding this address to your contacts prevents links from landing in spam or Gmail’s “Promotions” folder.

See also: Privacy and deletion, iOS app guide, Free vs paid plan