Why return the empty string? It makes more sense to fail fast and throw an `IllegalArgumentException`. Plus, I'm concerned about the security implications of returning the empty string as the encoded password.