requires base64 encoding for passwords