Just send your users a login link to their email. If you go with passwords, you already have a risk vector for resetting passwords. Skip the password and the r

Just send your users a login link to their email. If you go with passwords, you already have a risk vector for resetting passwords. Skip the password and the reset. Make the login link expire after 10 minutes so they attackers only have a short window.