Some data come from attacker. And not all attackers know that passwords
should be in UTF8, so accept everything simply as raw data.