I would go further: "passwords are ancient and (should be) obsolete". If you can don't rely on passwords, use hardware security keys and protocols like U2F and

I would go further: "passwords are ancient and (should be) obsolete". If you can don't rely on passwords, use hardware security keys and protocols like U2F and other FIDO2 related protocols. Sure you might still have a pin, but now you rely much less on it so it can be much simpler. If you can't use word phrases instead of passwords, e.g. 4 randomly selected words, and yes randomly selected for the user, not choose by the user. But with a way to "re-roll" when setting the pass phrase. As a side effect of being more secure (then normal remembered passwords) and easier to remember. As a benefits they are also easier to insert on phones with swipe keyboards and have some nice tricks wrt. internationalization you could use. (Make sure they still work with password managers.) Practically maybe not possible currently, but if you already rely on a password manager there is technical very little reason not to replace passwords with a U2F/FIDO like process connecting to the password manager. This might be less secure than a HSK but still nice. Ah, anyway that's currently not a think. Lastly if your service isn't generally "security sensitive" and login sessions tend to be long consider login links send to your password reset email. Especially if combined with password-less fido auth based on the browser + TPM this can be a nice approach (you use password-reset-like links to setup password-less fido auth on the given device).