Logins are always under attack. Hackers trying to guess passwords, or use stolen ones they found on the dark web, etc.
What do you use to protect your apps? Do you use 2FA? Do you use a service that provides third party authentication for you?
Lately I've been using next-auth with magic links. That way I offload all MFA/password reset/etc... to the identity provider and don't have to worry about passwords at all. Makes life very simple :)
This is exactly why you should offload your login/authentication to a third party and focus on your product. Also, the best solution and ease of maintenance (password resets issues) is to implement a passwordless solution.
The most popular passwordless authentication methods include:
Give us a try at https://tryonzauth.com we support 1,2 and 3 via WebAuthN standards and you can implement it in 5 mins or less.
The first line of defensive is never let your users use passwords. There is no good reason to provide that as an option in 2021. Then it comes down to what features do you need. There are a lot of aspects that may or may not be critical for users. Do you have IoT devices, how about device login (TV, etc...), desktop or mobile experience? Do you have users sharing the same account, or are users isolated with their own accounts and do not share data.
This is what we share with our customers when they are looking for an Auth solution comparison guide