Compared to saved passwords in terms of usability: it adds extra steps, potentially several, which is annoying. Compared to passwords in terms of security: you

Compared to saved passwords in terms of usability: it adds extra steps, potentially several, which is annoying. Compared to passwords in terms of security: you have to consider that the client visiting the link might not be the client with the session being authenticated, at which point there might be confusion over multiple authentication requests of mixed legitimacy around the same time. I don’t know how this is typically solved. I think better than either for security and usability is passwordless WebAuthn with a local factor (e.g. Touch ID for Apple devices, or even a master password for a simple improvement over existing password-unlockable saved passwords), if implementing something outside the status quo. (edit: starbugs’s point about latency is also very important.)