Fix passphrase generation

I see, but I dont like the idea that only with looking our server's access log or a proxy logs, someone could retrieve the encrypted profile.