Another point worth considering: even if your site or app does require user accounts (and this is not a given), that's not the same as requiring a password logi

Another point worth considering: even if your site or app does require user accounts (and this is not a given), that's not the same as requiring a password login. For each user, just store a unique token and secret in local storage. That's their identity and password. So long as they log back in using the same machine (and they don't log out or are in incognito mode or whatever), they're good. For most sites or apps, this will be good enough for 90% of your users 90% of the time. Now if you want to enable logging back in on another device, just ask for an email during your sign up. Then, when your user logs in from another device, you can email a login link that resets a new token / secret. Maybe a little more inconvenient for the user than just asking for a password, but it's a fairly minor inconvenience and it saves you from having to deal with storing passwords and worrying about screwing that up. Plus it removes a step from your first-time sign up process! Which probably matters more than ease of re-logging in from another device.