Passwordless — we send a one-time code. Your verified email/phone is the sign-up step (no password to leak).