password generation callback step one