diff --git a/data/nvm.toml b/data/nvm.toml
index 73fafcbe4c..427cc92397 160000
--- a/data/nvm.toml
+++ b/data/nvm.toml
@@ -1 +1 @@
-Subproject commit 73fafcbe4c66b23df63be31e9227353b695abb08
+Subproject commit 427cc923976229bcb981ca6f218ebe8efd636df6
diff --git a/locale/circuitpython.pot b/locale/circuitpython.pot
index f87fc02975..16ff1b38cc 100644
--- a/locale/circuitpython.pot
+++ b/locale/circuitpython.pot
@@ -98,6 +98,9 @@ msgstr ""
 #: ports/raspberrypi/common-hal/analogio/AnalogOut.c
 #: ports/raspberrypi/common-hal/rtc/RTC.c ports/stm/common-hal/alarm/__init__.c
 #: ports/stm/common-hal/canio/Listener.c ports/stm/common-hal/rtc/RTC.c
+#: shared-bindings/audiobusio/I2SOut.c shared-bindings/audiobusio/PDMIn.c
+#: shared-bindings/keypad/KeyMatrix.c shared-bindings/keypad/Keys.c
+#: shared-bindings/keypad/ShiftRegisterKeys.c
 msgid "%q"
 msgstr ""
 
@@ -193,7 +196,7 @@ msgstr ""
 msgid "%q must be array of type 'H'"
 msgstr ""
 
-#: shared-bindings/synthio/MidiTrack.c shared-bindings/synthio/__init__.c
+#: shared-module/synthio/__init__.c
 msgid "%q must be array of type 'h'"
 msgstr ""
 
@@ -1117,10 +1120,6 @@ msgstr ""
 msgid "I2C peripheral in use"
 msgstr ""
 
-#: shared-bindings/audiobusio/I2SOut.c
-msgid "I2SOut not available"
-msgstr ""
-
 #: ports/raspberrypi/bindings/rp2pio/StateMachine.c
 msgid "In-buffer elements must be <= 4 bytes long"
 msgstr ""
@@ -1282,6 +1281,10 @@ msgstr ""
 msgid "Invalid format chunk size"
 msgstr ""
 
+#: shared-bindings/wifi/Radio.c
+msgid "Invalid hex password"
+msgstr ""
+
 #: ports/espressif/common-hal/wifi/Radio.c
 msgid "Invalid multicast MAC address"
 msgstr ""
@@ -1708,10 +1711,6 @@ msgstr ""
 msgid "Oversample must be multiple of 8."
 msgstr ""
 
-#: shared-bindings/audiobusio/PDMIn.c
-msgid "PDMIn not available"
-msgstr ""
-
 #: shared-bindings/pwmio/PWMOut.c
 msgid ""
 "PWM frequency not writable when variable_frequency is False on construction."
diff --git a/py/argcheck.c b/py/argcheck.c
index 73f3ead269..465a82c97e 100644
--- a/py/argcheck.c
+++ b/py/argcheck.c
@@ -268,19 +268,6 @@ mp_int_t mp_arg_validate_type_int(mp_obj_t obj, qstr arg_name) {
     return an_int;
 }
 
-mp_int_t mp_arg_validate_valid_hex_password(mp_uint_t length, uint8_t *buf) {
-    unsigned int i=0;
-    while (i<length) {
-        if (!(('0' <= buf[i] && buf[i] <= '9') ||
-              ('a' <= buf[i] && buf[i] <= 'f') ||
-              ('A' <= buf[i] && buf[i] <= 'F'))) {
-            mp_raise_ValueError_varg(translate("Invalid hex character in password."));
-        }
-        i++;
-    }
-    return 0;
-}
-
 NORETURN void mp_arg_error_invalid(qstr arg_name) {
     mp_raise_ValueError_varg(translate("Invalid %q"), arg_name);
 }
diff --git a/py/runtime.h b/py/runtime.h
index 6856bb8c7a..d154772508 100644
--- a/py/runtime.h
+++ b/py/runtime.h
@@ -114,7 +114,6 @@ mp_obj_t mp_arg_validate_type_in(mp_obj_t obj, const mp_obj_type_t *type, qstr a
 mp_obj_t mp_arg_validate_type_or_none(mp_obj_t obj, const mp_obj_type_t *type, qstr arg_name);
 mp_int_t mp_arg_validate_type_int(mp_obj_t obj, qstr arg_name);
 mp_obj_t mp_arg_validate_type_string(mp_obj_t obj, qstr arg_name);
-mp_int_t mp_arg_validate_valid_hex_password(mp_uint_t length, uint8_t *buf);
 
 static MP_INLINE mp_obj_dict_t *mp_locals_get(void) {
     return MP_STATE_THREAD(dict_locals);
diff --git a/shared-bindings/wifi/Radio.c b/shared-bindings/wifi/Radio.c
index 73cceea73b..7c6175590b 100644
--- a/shared-bindings/wifi/Radio.c
+++ b/shared-bindings/wifi/Radio.c
@@ -29,6 +29,7 @@
 
 #include <string.h>
 
+#include "py/unicode.h"
 #include "py/runtime.h"
 #include "py/objproperty.h"
 
@@ -70,6 +71,14 @@ STATIC bool hostname_valid(const char *ptr, size_t len) {
     return !(partlen > 63);
 }
 
+STATIC void validate_hex_password(const uint8_t *buf, size_t len) {
+    for (size_t i = 0; i < len; i++) {
+        if (!unichar_isxdigit(buf[i])) {
+            mp_raise_ValueError_varg(translate("Invalid hex password"));
+        }
+    }
+}
+
 
 //| class Radio:
 //|     """Native wifi radio.
@@ -321,6 +330,9 @@ MP_DEFINE_CONST_FUN_OBJ_1(wifi_radio_stop_station_obj, wifi_radio_stop_station);
 //|         ``OPEN`` will be used when the password is the empty string,
 //|         otherwise ``authmode`` will be ``WPA_WPA2_PSK``.
 //|
+//|         The length of ``password`` must be 8-63 characters if it is ASCII,
+//|         or exactly 64 hexadecimal characters if it is the hex form of the 256-bit key.
+//|
 //|         If ``max_connections`` is given, the access point will allow up to
 //|         that number of stations to connect."""
 //|         ...
@@ -368,8 +380,8 @@ STATIC mp_obj_t wifi_radio_start_ap(size_t n_args, const mp_obj_t *pos_args, mp_
 
     if (authmodes != AUTHMODE_OPEN) {
         mp_arg_validate_length_range(password.len, 8, 64, MP_QSTR_password);
-        if (password.len==64) {
-            mp_arg_validate_valid_hex_password(password.len, password.buf);
+        if (password.len == 64) {
+            validate_hex_password(password.buf, password.len);
         }
     }
 
@@ -409,6 +421,9 @@ MP_PROPERTY_GETTER(wifi_radio_ap_active_obj,
 //|         """Connects to the given ssid and waits for an ip address. Reconnections are handled
 //|         automatically once one connection succeeds.
 //|
+//|         The length of ``password`` must be 0 if there is no password, 8-63 characters if it is ASCII,
+//|         or exactly 64 hexadecimal characters if it is the hex form of the 256-bit key.
+//|
 //|         By default, this will scan all channels and connect to the access point (AP) with the
 //|         given ``ssid`` and greatest signal strength (rssi).
 //|
@@ -449,8 +464,8 @@ STATIC mp_obj_t wifi_radio_connect(size_t n_args, const mp_obj_t *pos_args, mp_m
         mp_get_buffer_raise(args[ARG_password].u_obj, &password, MP_BUFFER_READ);
         if (password.len != 0) {
             mp_arg_validate_length_range(password.len, 8, 64, MP_QSTR_password);
-            if (password.len==64) {
-                mp_arg_validate_valid_hex_password(password.len, password.buf);
+            if (password.len == 64) {
+                validate_hex_password(password.buf, password.len);
             }
         }
     }