fix: might not have worked for passwords with even number of characters