What a password is: a key Why we use a short text key: to keep it [most of the time] in meatspace, outside the domain of most attackers What email tokens are:

What a password is: a key Why we use a short text key: to keep it [most of the time] in meatspace, outside the domain of most attackers What email tokens are: temporary keys Why we don't use them: 1) they don't work offline 2) they require access to multiple networks 3) they can be intercepted easily 4) delivery is not efficient or guaranteed 5) they can be used for parallel attacks Many sites don't control use of email tokens with things like security questions or a second factor, which makes it easy to use email as an invisible vector of attack. If you're going to remove passwords you need some additional authentication methods.