I've wanted to bite the bullet with this, but not enough of a security expert to do it confidently. How does this stack up? I like the idea of keeping someone

I've wanted to bite the bullet with this, but not enough of a security expert to do it confidently. How does this stack up? I like the idea of keeping someone logged in, then they can choose to log back using whichever means they decided when creating their account - email, SMS, authenticator app.