default password to empty string