5. Email a login link to the users verified email address. No need for a password.
Maybe if the information on the site was sensitive it would be worth it, but this is too much for just any random app.
Plus the whole thing becomes unsecure if users start forwarding the email to others without thinking of the implications.
What if the link is only good once? Problem solved.
I've just never actually seen anyone else do it.For some reason, it feels 100x more complicated than checking my SMS app for an SMS code when in reality its not that different.