Yes, right now it's only password. I was planning to add webauthn later as second factor.