Can passwords be `null`, too?