For my use case, account sharing isn't something anyone would want to do, and I totally agree about not even thinking about using social logins (I hate them too

For my use case, account sharing isn't something anyone would want to do, and I totally agree about not even thinking about using social logins (I hate them too). The multiple sessions is a very good point that I didn't think about. I think to properly implement passwordless logins you would end up still needing a DB lookup on each login because you would need a way to invalidate / blacklist tokens on the server side (for disabling accounts on demand). So with that said, multiple sessions is likely a solved problem by just seeing if a token is already set for that user, and if it is, write that one back to their other device's cookies instead of generating a new one. Seems fool proof? My reason for wanting to ditch passwords is mainly to protect users. I've coded an end to end password based login solution in like 4 different frameworks about a dozen times so I'm cool with doing it either way, but I do really think passwordless logins have real advantages outside of just eliminating crappy passwords.