probably not a good idea to allow users to set password folder name