password should be 8 characters or longer