If I understand correctly, you are only asked to fill in a few of the 8 characters. (I have seen this before.) You are presented with * * [ ] * [ ] * * [ ] a

If I understand correctly, you are only asked to fill in a few of the 8 characters. (I have seen this before.) You are presented with * * [ ] * [ ] * * [ ] and you are supposed to submit * * [3] * [5] * * [8] so neither side would have enough information to reconstruct the full password based on the user's input alone.