why is char preferred over string for passwords