make sure pw is not stored in plain text..better than nothing :/