passphrase is empty instead of 'more secure' array of chars