An email code instead of a password
Nothing to create, reuse or leak. You enter your email address, we send a one-time code, you type it in.
Designed around
OpenID Connect
OAuth 2.0 + PKCE
One-time email codes
Passkeys and authenticator apps planned
How a sign-in works
Four steps, no password.
- Start on any site that uses OzlyIt sends you to accounts.ozly.dev, the one address where you sign in.
- Enter your email addressWe send a six-digit code. The page answers the same way whether or not an account exists.
- Type the codeIt works once, expires after 10 minutes and allows a limited number of attempts.
- Return to the site, signed inThe site receives a short-lived token from Ozly. It never sees your code.
What Ozly does
One place for sign-in, plans and limits.
One account, many sites
Sites recognise you through open standards, so you sign up once.
Plans and usage together
What you can do on each product, and how much you have used, lives with your account.
Standards, not inventions
Ozly speaks the same protocols as the large identity providers, and stores as little as it can.
- Codes are stored hashed, never in clear
- One canonical sign-in address
- Sessions you can see and end
The only email we send.
Ozly sends transactional email only: the sign-in code you asked for, and security notices about your own account, such as a sign-in from a new device.
We do not send marketing, newsletters or promotions, and we do not use purchased or shared mailing lists. Only addresses that someone typed into our sign-in page ever receive mail.
- Sent from
- login@ozly.dev and security@ozly.dev
- Authenticated
- SPF, DKIM and DMARC on ozly.dev
- Bounces
- Addresses that bounce or complain are suppressed and never mailed again
- Replies
- Go to support@ozly.dev