bug:password length