One time password is safe since it is generated per access and thus cannot be brute forced or deduced.

Passwords can be compromised more easily than to replicate a physical thing like key card, fingerprint or retina.

Its administrator's job to ensure that password of the user remains private and is known only to user. But while making a new user account he assigns a random general password to give it to user. Thus even administrator cannot access a particular users account.

It has a combination of Alphabet both capital and small along with number and special character. Thus always use complex password with a combination of all these.