use at least 4 random characters