a bit safer pwd-short