Nexus does not use the email and password pair you keep reusing everywhere else. It uses three things of your own making, and each one breaks in a different way.
The withdrawal PIN
The PIN is set at signup and asked for when coins leave the balance. It does not sign you in, it does not move money out of escrow, and it does not restore anything. Its only job is to stand between a stranger at your open browser and a transfer request to an address that is not yours, which is exactly what a clone site with a login form is fishing for.
The mnemonic recovery key
It is issued once and it is the whole account: change the browser, lose the profile, reinstall the phone, and the mnemonic is the only thing that brings the balance and the order history back. Since the same string rebuilds the account on any of the three published endpoints, the note holding it is the most valuable object in the setup, and a phone that syncs its photo library to a cloud copies that object onto somebody else's storage.
2FA and PGP
Two factor is an option and applies to the login. PGP is not optional inside the market: messages with vendors are encrypted with your key, and the key you paste at signup is the one the shop will use for that correspondence afterwards, so a key you cannot keep is a message you cannot read later.
Account questions
How do I log into Nexus Market without a password?
The account screen asks for a name, a pasted PGP key, the captcha picture and a withdrawal PIN. There is no email field and no password field, which is why the mnemonic recovery key matters more than the PIN.
What is the mnemonic recovery key?
The only backup of the account. The PIN protects withdrawals; the mnemonic is what restores the account, the balance and the order history if the browser profile is gone.
Where do I keep it?
Offline, in writing. A screenshot in a phone gallery is the weakest place to keep the one string that rebuilds an account, and a cloud backup syncs it to a machine you do not control.
Is 2FA worth switching on?
Yes, and it costs nothing on a shared device: the second factor blocks a login even with the mnemonic. It is offered as an option, not forced, and it protects the login only, not the withdrawal, which stays behind the PIN.