Illegal chars in passwords