We send a link rather than asking for a password. It is valid for fifteen minutes and can be used once.