Passwordless, Passwords, Argon2, Encryption, Cryptography.
login once for the duration of their session which might be long lived. In addition to the above steps: Use a CAPTCHA to prevent an end user from brute forcing. Make sure a rate limiting rule is put in based on the IP address to prevent replay attacks. Prevent more than n (n~3) incorrect attempts