better way to deal with passwords