password needs to be private