Why not just hash the password and use the first 8 characters of the hash? That would at least stop things from being stored in plain text.