up to 10 chars for password