That's how you do passwords. The alternative you are looking for is keys, and the entire internet decided those are toxic and no user must be able to handle them (except for the ones that give monopoly over authentication to Apple and Google, a lot of people like those).