this should be after password_mask since 's' comes before 't'