Note when using multiple devices in the case of the email-based auth if the code is not simple enough then you end up with having to setup email sync on all dev

Note when using multiple devices in the case of the email-based auth if the code is not simple enough then you end up with having to setup email sync on all devices ... And even if simple enough it relies a lot on cookies to avoid the hassle of the flow and become absolute crap when using private session or a cookie cleaner. For the "personal project where security isn’t critical" use-case half the time the site would be better without authentication and the other half I'll probably use my default crapshot password because it's not worth more effort. Edit: on the dev part it's not even simpler than a password solution since in the example the token is stored server-side and you still need to send emails. If you don't care about session invalidation then you could just rely on the token with a bit of encryption/hashing. Another edit: you could probably just add an optional password field to the flow and obtain something more flexible for the user without adding much complexity. -> When creating an account not much diff -> When logging if you have the correct password then great otherwise send the token -> When entering the token add optional password to update