Why is email the backbone of online identity (logins, 2FA)?

Email became the default identity anchor on the internet because it's universal, persistent, and human-readable. When the web started growing in the mid-90s, every service needed a way to identify users across sessions. They could have used phone numbers (not everyone had one), addresses (too static and privacy-invasive), or invented new identity systems (zero adoption). Email was already there. You had one, it didn't change often, and it worked everywhere.

The architecture matters too. Email addresses are globally unique identifiers that don't depend on any single company. No one owns the format. Gmail can't ban Outlook addresses from working. That makes email a neutral standard. When Amazon and eBay and PayPal all launched within a few years of each other, they each needed an identity system that wouldn't lock them into a competitor's ecosystem. Email was the only option that fit.

The "Forgot Password" link is where this really shows up. Every reset flow routes through email because your inbox is the one place services assume only you can access. (That's also why compromised email accounts are so dangerous.) The password reset became the de facto proof of ownership for every account you've ever created. Banks, shopping sites, work tools, social media accounts all trust that if you control the inbox, you control the identity.

Two-factor authentication (2FA) often relies on email for the same reason. Services send codes to your inbox because they know you'll check it and they know it's tied to you. Other methods exist now (authenticator apps, SMS, hardware keys), but email remains the fallback when those fail. If you lose your phone, you reset via email. If you switch devices, you verify via email. Email is the recovery layer underneath every other identity method.

The downside: this makes your inbox a single point of failure. If someone gains access to your email, they can reset passwords for everything else you own. That's why securing your email account with 2FA is one of the most important things you can do for your overall online security. And it's why services treat password reset emails with extra care. If those don't deliver, users are locked out. (That's also why password resets landing in spam is such a nightmare for transactional senders.)

Email won this role not because it's perfect, but because it was the only system that already worked everywhere when the web needed an identity layer. And now, 30 years later, switching away would mean re-verifying billions of accounts. So email remains the backbone, for better or worse.