not sure this is ideal, i can see someone complaining that the number of characters doesn't match their password... perhaps using `[hidden]` would be more clear?