Make at least a password of 32 characters. i have got a couple of NXT accounts for different use cases and every account has a password longer than 100 characters. they are very likely unhackable
Yes but someone could steal your coins without stealing your computer if your password is weak.
I don't see how any of this pertains to decentralization though

Don't make a weak password?
He was asking whether it was a server-side login, rather than a client side.