always use secure char sequence for password