What I do is similar. I use auth0, and have it configured for passwordless use. If you have a Google Account or Microsoft Account then you can simply use the

What I do is similar. I use auth0, and have it configured for passwordless use. If you have a Google Account or Microsoft Account then you can simply use the OIDC / OAuth flow and have those third parties that you trust identify you and handle the authentication... we only ask for an email as it's necessary for our service. Because it's only auth0 talking to the identity provider, Google and Microsoft don't actually get to see which site you're signing into. If you don't have those, then you can just use an email code. We email you a single-use expiring (15 minutes) code, you enter it and gain access. In this scenario email becomes your identity. I use private browsing for everything... this is a bit inconvenient as password managers cannot handle this email verification flow. But for me that's good... I want this level of security for myself, I want the service not to be storing passwords whilst also not permitting identity providers to know what I'm signing into.