If password is already a Buffer, maybe this conversion should be through "hex" instead of "utf8". (This isn't such a big deal for `password`, since it's probably safe to assume it was typed by a user at some point and thus should fit in the utf-8 space.)