[Security] limited the password length passed to encoders