Ghosty has no passwords — not as an option you skipped, but by design. There's nothing to remember, nothing to reuse across sites, and nothing that can leak in a breach. You sign in with something you already own: your email inbox, your Google account, your GitHub account, or a passkey on your device.

Your email address is your account. However you sign in, everything — your apps, your team memberships, your invites — is tied to your verified email, and every sign-in method that reaches the same address reaches the same account.

Email link (works for everyone)

Enter your email at console.getghosty.dev and we'll send you a one-time sign-in link. Open it on the same device and you're in.

• Links expire after 15 minutes and work exactly once. Opening the link shows a Finish signing in button — the link isn't spent until you click it, so an email preview can't use it up.
• The first sign-in is the sign-up — if the address is new to Ghosty, your account is created on the spot.
• Didn't get it? Check spam, then use Resend link on the sign-in page.

Using a company email address? Some corporate mail systems (Microsoft Defender / Outlook Safe Links and similar) open every link in every email automatically. Sign-in links are built to survive that, but if yours ever arrive already expired or "already used", ask your IT team to exempt getghosty.dev, console.getghosty.dev, and *.app.getghosty.dev from link scanning — or add a passkey (below) and skip the inbox round-trip entirely.

Continue with Google

If you prefer, click Continue with Google and pick your account. Google confirms your email address to us, and you land in the same Ghosty account that address always names — use the link one day and the button the next, it's the same account either way.

If your Google account's address is unverified, Google sign-in is refused; use the email link instead (the link itself is the verification).

Continue with GitHub

Building from a GitHub account already? Continue with GitHub signs you in with it. We use the verified email address on your GitHub account — your primary one if it's verified, otherwise any verified address — and you land in the same Ghosty account that address always names. Your email can stay private on your GitHub profile; sign-in still works.

If none of your GitHub addresses are verified, GitHub sign-in is refused; verify one there first, or use the email link instead.

Passkeys

A passkey lets you sign in with your fingerprint, face, or device PIN — one tap, no inbox round-trip. Passkeys live on your device (or in your phone's or browser's built-in manager, which can sync them across your devices) and only ever work on Ghosty's real sign-in page, so there's nothing to type and nothing a fake page can trick out of you.

To set one up, sign in however you like, then go to Settings → Passkeys → Add a passkey and follow your device's prompt. Do it once on each device you sign in from — or let your passkey manager sync it for you. Next time, click Sign in with a passkey on the sign-in page and confirm with your fingerprint, face, or PIN. You land in the same account as always.

Lost the device? Nothing is locked away: sign in with your email link (or Google/GitHub) and remove that passkey from Settings → Passkeys.

Signing out

Use Sign out from the account menu. Sessions also expire on their own after 24 hours, so a forgotten library computer signs you out by itself.