password spec and attribute