# Firebase authentication email verification

> Firebase Authentication email verification sends a link for a signed-in user and records whether that address is verified.

Firebase Authentication email verification is an account-management action for a signed-in user. Firebase can send that user an address-verification email, and the user record exposes an `emailVerified` state. This differs from signing in with an email and password or with an email link. A verified Firebase address also does not establish whether an outgoing message passed [SPF](https://www.rfc-editor.org/rfc/rfc7208), [DKIM](https://www.rfc-editor.org/rfc/rfc6376), or [DMARC](https://www.rfc-editor.org/rfc/rfc7489).

## Quick takeaways

- Firebase documents `sendEmailVerification` for the current signed-in user.
- The user profile includes an `emailVerified` property.
- Email-link sign-in verifies the address when that documented flow completes.
- Email/password uses a separate password credential flow.
- Sender-domain authentication and Firebase user verification answer different questions.

## What Firebase email verification does

Firebase's [Manage Users documentation](https://firebase.google.com/docs/auth/web/manage-users) shows `sendEmailVerification` for `auth.currentUser`. In the same Web documentation, the current user's profile includes the `emailVerified` property. Those details describe a user-account state and the action that begins verification. They do not document inbox delivery timing, a Firebase Console path, or an application's own policy for what it permits before the user completes verification.

```text
Current signed-in Firebase user
  -> sendEmailVerification
  -> user completes the verification link
  -> inspect emailVerified in the user profile
```

If you are building the flow, use Firebase's current platform documentation for the actual SDK call and the point at which your application refreshes or reads the user state. This article only clarifies which Firebase task the email relates to.

## How verification differs from Firebase email sign-in

Firebase [email/password authentication](https://firebase.google.com/docs/auth/web/password-auth) is a provider and credential flow: the user signs in with an email address and password. Firebase's [Email Link documentation](https://firebase.google.com/docs/auth/web/email-link-auth) describes a different passwordless flow that completes sign-in through a received link. Firebase states that this completed Email Link flow also verifies the email address.

That qualification matters. Email Link can include address verification as part of its documented completed sign-in flow. Sending a verification email is the separate action to use when the question is whether an existing signed-in user's address has been verified. For the broader choice between the two sign-in methods, see [Firebase authentication email](/learning/firebase-authentication-email).

## Choose the right Firebase email task

Use this decision flow to identify the Firebase action that matches the user state before treating any email message as evidence of verification.

![Decision flow separating password credentials, email-link sign-in, and verification for an existing signed-in Firebase user.](/images/editorial/firebase-authentication-email-verification/firebase-authentication-email-verification-flow.svg "1200x760")

*Source: Original Palisade decision flow summarizing Firebase's [Manage Users documentation](https://firebase.google.com/docs/auth/web/manage-users), [Email Link documentation](https://firebase.google.com/docs/auth/web/email-link-auth), and [email/password documentation](https://firebase.google.com/docs/auth/web/password-auth). It is a conceptual summary, not a Firebase interface or project-specific configuration. [Open the full-size decision flow](/images/editorial/firebase-authentication-email-verification/firebase-authentication-email-verification-flow.svg).*

The flow is deliberately narrow: it does not show Firebase Console settings, template options, inbox delivery, or any sender-domain authentication result.

## Check the state without mixing tasks

### 1. Identify the user's starting state

Ask whether the person is signing in with a password, completing an Email Link sign-in, or already signed in and waiting to verify an address. These are different Firebase tasks even though all can involve an email address.

### 2. Use the matching Firebase flow

Use the Email/Password or Email Link flow when the question is how the user signs in. Use the account-management verification action when the question concerns the existing user's email-verified state. Follow the current Firebase documentation for the platform your application uses.

### 3. Read the verification state in the user context

After the documented verification flow completes, evaluate `emailVerified` in the application's Firebase user context. Do not use the existence of a sent message as proof that the user completed the link or that the application has refreshed its state.

## Keep sender authentication separate

[SPF](https://www.rfc-editor.org/rfc/rfc7208) evaluates whether a host is authorized to use a domain in mail sending. [DKIM](https://www.rfc-editor.org/rfc/rfc6376) uses a cryptographic signature to associate a responsible signing domain with a message. [DMARC](https://www.rfc-editor.org/rfc/rfc7489) uses SPF or DKIM results and identifier alignment for the visible From domain. Firebase's documentation instead describes verification as a state on an application user. It follows that a sender-domain check cannot prove that a Firebase user completed verification, and a verified Firebase user cannot prove a message passed sender-domain authentication. See [what email authentication is and why it matters](/learning/what-is-email-authentication-and-why-does-it-matter) for the sender-domain question.

An [email authentication checker](/learning/email-authentication-checker) can inspect published domain evidence, but it cannot inspect a Firebase user's `emailVerified` state, a private inbox, or a completed application flow. Use Firebase's documentation and your application's own authorized user-state checks for those questions.

## Sources and further reading

- [Firebase: Manage Users](https://firebase.google.com/docs/auth/web/manage-users)
- [Firebase: Authenticate with Firebase Using Email Link in JavaScript](https://firebase.google.com/docs/auth/web/email-link-auth)
- [Firebase: Authenticate with Firebase using Password-Based Accounts using JavaScript](https://firebase.google.com/docs/auth/web/password-auth)
- [IETF email-authentication specifications: SPF (RFC 7208), DKIM (RFC 6376), and DMARC (RFC 7489)](https://www.rfc-editor.org/rfc/rfc7489)

## Frequently asked questions

### Does sending a Firebase verification email mean the address is verified?

No. Sending the message begins Firebase's documented verification action for the current user. Treat `emailVerified` as the relevant user-profile state, and ensure your application handles the completed verification flow before relying on that state.

### Does Firebase Email Link sign-in verify the email address?

Yes. Firebase documents that the completed Email Link sign-in flow verifies the user's email address. That is specific to the completed Email Link flow, rather than a rule that every Firebase email/password user is already verified.

### Is Firebase email verification the same as password reset?

No. Email verification concerns the user's address-verification state. Firebase documents password reset as a separate `sendPasswordResetEmail` account-management action, so it should not be used as evidence that an address is verified. See [Firebase: Manage Users](https://firebase.google.com/docs/auth/web/manage-users).

### Does Firebase email verification prove DMARC passed?

No. Firebase email verification concerns an application user's address state. [DMARC](https://www.rfc-editor.org/rfc/rfc7489) evaluates aligned SPF or DKIM authentication for the visible From domain, so the two results cannot establish each other.

### Should an app require a verified Firebase email before access?

Only if that requirement matches the application's own policy and user journey. Firebase documents the verification action and user state, but the application owner decides which actions, if any, depend on a verified address.