Check the contents of passwords, not just the length