use charAt instead of substring to extract random character
externalize default password size
remove test that doesn't compile