Firstly this class is not really SASL specific so should be in a general util package.

Secondly we now have password specs and a PasswordFactory - if this class still has a future then maybe it should be using those instead of it's own custom implementation.