A reset link lands in your inbox and is good for two hours. Biometrics and the QR code on the sign-in page never need a password at all.