mkpasswd: do not write outside the buffer

"$x$" + 16 + "$\0" is more than 20...