use first character of password to determine SHA256 passes