The test student accounts will never be logged into, so it might be able to get away without setting a password at all.

The bcrypt function used for hashing the passwords is extremely slow (by design, to prevent brute-forcing), so that will tax the slow CPU on devices like the Pi. Logging in is similarly slow, but in generating the fake data, it's doing many at once, so if there's no need to set a password, it'd be great not to.

Hmm, unless we want to be able to log in as a test student to show a populated account? Hadn't thought of that.