use pwgen for secrets