Holding a manually chosen password can be a privacy violation because it&#x27;s a small peek into the user&#x27;s psyche.  (I wouldn&#x27;t say the employee &quot;changeme&quot;, &quot;instagram&quot; etc. passwords count, although the act of running a password cracking tool meant that he <i>could</i> have seen a more personal password.)<p>Holding some randomly generated numbers that <i>could</i> be used to access a server is not.