[Zikes]

A new "password" is sent to you over a secure channel you control each time you log in.

For example, say your session has timed out. You click the log in button and provide your username, and a couple of moments later you receive an email with a one-time-use link that you click to take you back to the site and log you in.

Another example: you click log in and provide your username. A few moments later you receive a text message with a 6-7 character one-time-use token that you type into a text field on the web site. The web site then logs you in.

In both cases the login requires you have immediate access to a secure channel you specified at the time you set up the account. The token or link provided via those channels are only valid for a single use and if left unused expire in a fairly brief period regardless.

[pgeorgi]

"a text message" is not a secure channel.

[kelnos]

No, but for many use cases it's secure enough. Especially when you consider the tokens are short-lived and single-use