Password isn't used directly as key. The key is derived with PBKDF.