Yeah, if a level is passworded, chances are it's either a community level (like a hotel, or an anneversary bash level pack) or not worth looking at and playing. It's not like someone puts their personal info in a level so you can't really call the password remover "malicious," just simply something a major anus would have.

As for "must-haves," just look up "Tileset," "SP," and "Battle" in the J2O downloads section. The best levels will automatically float to the top.