You can sign in to Signet with an email and password, a one-click magic link sent to your email, or your Google account. Passwords are stored only as secure hashes, never in plain text.
Two-factor authentication (an authenticator app) is on our roadmap and not yet available. When it arrives, you'll be able to turn it on from Settings, Security, where you'll also find a placeholder for it today.
People who only receive a link to sign never create an account, so there's nothing for them to set up.