There is another passwordless system called SQRL which is automated and more secure. From the user's perspective, they scan a QR code or click a browser extension and are signed into the site. Behind the scenes, a cryptographic challenge (a response URL + nonce) is presented to the user's phone or browser extension. The client signs the challenge using a per-site private key and sends the result to the provided URL.
https://www.grc.com/sqrl/sqrl.htm