changed: password length