move pw to config