password should be stared