No passwords! At all!
---------------------
I would like to add to previous, excellent answers that it's possible to create a login-site which neither demands nor store passwords.

Use case
--------
This is what it would look like when the user wants to login on a password-less site...

 1. The user enters his/her email adress.
 2. An email with a login link is sent (much like when one resets a password on a traditional site).
 3. The user follows the link.
 4. The website uses the login token in the link to login the user.
 5. The user is kept logged in for X days. The login link expires after a few minutes.
 6. After X days the user is automatically logged out and need to login again.

Basically a "Reset password" function used as login.

Pros
----
 - No password for the user to remember.
 - No password stored in the server that can be stolen.
 - Can be combined with two-factor-authentication.

Cons
----
 - A new way to login which the user might not be familiar with.
 - E-mails might be delayed making a login taking longer than desired.
 - Not compatible with password managers.

Further reading
---------------
 - https://www.lucius.digital/en/blog/login-without-password-most-secure-wait-what
 - https://lukeplant.me.uk/blog/posts/a-simple-passwordless-email-only-login-system/