Comment by miki123211

Which is why you want magic links.

Don't be the identity provider, have the email host be the identity provider (which it is anyway if you have a forgot password prompt).

Agreed 100% that nobody should still be using passwords in 2026 though.