format check for passwords