Use an HMAC-generated hash of the Matrix user ID as the password, so it's unguessable without the (private) secret but easily recreatable with it