initial version, do NOT use for production passwords!