You used random to generate passwords! It is literally so insecure that if the hacker could know when the account was created and knew the hash of the password then after like a day, he could hack barely 100 000 accounts! Just one day! This is because random uses system time which can be changed to any other number using seed() function. With that you can make it brute-force those numbers around the account creation time. Even if you choose an absolutely random password length that makes hash cracking A LOT FASTER. if you just pressing a lot of buttons then it will be random, current time is very easy to get.