# Firebase authentication email

> Firebase Authentication supports email/password and email-link sign-in. Learn how those flows differ from email verification and sender authentication.

Firebase Authentication can authenticate an application user by checking an email address and password, or by sending a one-time sign-in link to the address. Enable the Email/Password or Email Link provider in the Firebase project before using its flow. Email verification is a separate account-state action, and none of these application-user checks prove that the message passed SPF, DKIM, or DMARC.

## Quick takeaways

- Email/Password sign-in uses an email address with a password that the user supplies.
- Email Link sign-in sends a link that completes sign-in and verifies the user's email address in that flow.
- Sending a verification email for an existing email/password user is separate from choosing a sign-in method.
- Firebase application authentication and sender-domain email authentication answer different questions.

## How Firebase email sign-in works

Firebase documents two email-based sign-in choices for web applications. With [email/password authentication](https://firebase.google.com/docs/auth/web/password-auth), an app creates or signs in a user with an email address and password after the Email/Password provider is enabled. With [email-link authentication](https://firebase.google.com/docs/auth/web/email-link-auth), the app sends a sign-in link to the address and completes the sign-in after the user opens it.

The important distinction is the credential. An email/password flow checks a password credential. An email-link flow uses possession of the received sign-in link as part of its documented flow. Firebase says the email address is verified when the email-link flow completes, but that does not mean every email/password account is automatically verified.

## When the answer changes

Choose email/password when the application needs a password-based account and can safely support password creation, reset, and recovery. Choose an email link when the product wants a passwordless sign-in experience and can implement the documented link-handling flow. In both cases, enable the relevant provider in the Firebase project first.

Email verification is not a third sign-in method in this comparison. Firebase's [user-management documentation](https://firebase.google.com/docs/auth/web/manage-users) treats sending a verification email as an action on a signed-in user. Keep that task separate from password credentials and email-link sign-in, and from the narrower Firebase verification-email topic.

## Choose the Firebase email flow

Use this decision rule before you write code or change project settings.

![Decision diagram showing the three Firebase email-related tasks: password credentials, email-link sign-in, and verification for an existing user.](/images/editorial/firebase-authentication-email/firebase-authentication-email-flow.svg "1200x700")

*Source: Original Palisade decision card summarizing Firebase's [email/password documentation](https://firebase.google.com/docs/auth/web/password-auth), [email-link documentation](https://firebase.google.com/docs/auth/web/email-link-auth), and [user-management documentation](https://firebase.google.com/docs/auth/web/manage-users). It is not a Firebase Console interface or a substitute for project-specific configuration. [Open the full-size decision card](/images/editorial/firebase-authentication-email/firebase-authentication-email-flow.svg).*

```text
Need a password credential?
  Use Email/Password and enable that provider.

Need passwordless sign-in by message link?
  Use Email Link and handle the completed sign-in link.

Need to confirm an existing email/password user's address?
  Send a verification email as a separate account-management action.
```

## Apply the choice in the right order

### 1. Name the user-authentication task

Decide whether the user must enter a password, open a sign-in link, or verify an account that already exists. Do not treat these as interchangeable just because each uses an email address.

### 2. Enable the matching Firebase provider

Enable Email/Password for password credentials or Email Link for link-based sign-in, following the current Firebase documentation for the platform in use. Provider availability in a project is configuration evidence; an email message alone is not.

### 3. Keep sender authentication in its own lane

SPF, DKIM, and DMARC help receiving mail systems assess whether a domain is authorized to send a message. Our guide to [email authentication and why it matters](/learning/what-is-email-authentication-and-why-does-it-matter) explains that domain-level question. An [email authentication checker](/learning/email-authentication-checker) can help inspect published sender-domain evidence, but it cannot prove a Firebase user signed in or that an email-link flow completed.

If the issue is an SMTP submission or mailbox-login error, use [authentication failed email](/learning/authentication-failed-email) for the evidence relevant to that failure. It is not Firebase Auth provider configuration evidence.

## Sources and further reading

- [Firebase: Authenticate with Firebase using Password-Based Accounts using JavaScript](https://firebase.google.com/docs/auth/web/password-auth)
- [Firebase: Authenticate with Firebase Using Email Link in JavaScript](https://firebase.google.com/docs/auth/web/email-link-auth)
- [Firebase: Manage Users](https://firebase.google.com/docs/auth/web/manage-users)

## Frequently asked questions

### Is Firebase email authentication the same as email verification?

No. Firebase can authenticate a user through email/password credentials or an email sign-in link. Sending a verification email is a separate account-management action, although a completed email-link sign-in flow verifies the address in that documented flow.

### Does Firebase email-link sign-in require a password?

No. Firebase documents email-link authentication as a passwordless sign-in method. The application sends a sign-in link to the user's email address, then completes the flow when the user opens the link through the implementation's configured handling path.

### Does Firebase Authentication prove an email message passed DMARC?

No. Firebase Authentication concerns an application user's sign-in state. DMARC evaluates sender-domain alignment and authentication results at the receiving mail system, so it cannot be established by a Firebase credential or email-link completion.

### Should I use email/password or an email link?

Only use email/password when the product needs password-based accounts; use an email link when a passwordless link-based sign-in experience fits the product. In either case, follow Firebase's current provider and implementation documentation for the application platform.