Meanwhile, users actually type full password into the username field so they find the required characters by index, then delete it before submitting the form.