passwords can be any length, tho we recmnd 10+