Plenty of auth implementations that do stuff like this already, and like the other person said, if your email is compromised, you're already fucked.
Discuss the Paswordmanager Bitwarden.
Plenty of auth implementations that do stuff like this already, and like the other person said, if your email is compromised, you're already fucked.