Personally I would run a grep to find if someone has already been doing that. This is also difficult to use in forgotten password forms.