password done inclusion and exclusion