default to 10-char pws