Billionmail/BillionMail · error

password length must be at least 4 characters

Error message

password length must be at least 4 characters

What it means

For the ADMIN_PASSWORD key, validateConfigValue requires a minimum length of 4 bytes; shorter passwords are rejected. There is no maximum enforced here beyond the global 1024 limit. This is a weak minimum, so treat it as a floor, not a policy.

Source

Thrown at core/internal/controller/settings/settings.go:202

func validateConfigValue(key, value string) error {
	// Basic length check
	if len(value) > 1024 {
		return fmt.Errorf("configuration value too long, maximum 1024 characters")
	}

	switch key {
	case "ADMIN_USERNAME", "admin_username":
		// Admin username: allowed letters, numbers, underscores, length 4-32
		if len(value) < 4 || len(value) > 32 {
			return fmt.Errorf("admin username length must be between 4-32")
		}
		if !public.IsValidUsername(value) {
			return fmt.Errorf("admin username can only contain letters, numbers and underscores")
		}

	case "ADMIN_PASSWORD", "admin_password":
		if len(value) < 4 {
			return fmt.Errorf("password length must be at least 4 characters")
		}

	case "BILLIONMAIL_HOSTNAME", "billionmail_hostname":
		// Hostname: allowed letters, numbers, dots, hyphens
		if !public.IsValidHostname(value) {
			return fmt.Errorf("hostname format is incorrect")
		}

	case "SMTP_PORT", "SMTPS_PORT", "SUBMISSION_PORT", "IMAP_PORT", "IMAPS_PORT", "POP_PORT", "POPS_PORT", "HTTP_PORT", "HTTPS_PORT", "REDIS_PORT",
		"smtp", "smtps", "submission", "imap", "imaps", "pop", "pops", "http", "https", "redis_port":
		// Port: 1-65535
		port := public.ParseInt(value)
		if port < 1 || port > 65535 {
			return fmt.Errorf("port must be between 1-65535")
		}

	case "IPV4_NETWORK", "ipv4_network":
		// IPv4 network: CIDR format

View on GitHub (pinned to fc36c76c05)

Solutions

1. Set a password of at least 4 characters (prefer a strong 12+ character secret)
2. Check your automation/env for truncation before calling the API
3. Prefer generated secrets rather than hand-set short test passwords
4. Run the same len(value) >= 4 check client-side before submit

Example fix

// before
setConfig("ADMIN_PASSWORD", "abc") // rejected
// after
setConfig("ADMIN_PASSWORD", "S3cure-Passphrase!")

function isValidPassword(p) {
  return typeof p === 'string' && p.length >= 4;
}

function isAcceptablePassword(v: unknown): v is string {
  return typeof v === 'string' && v.length >= 4;
}

When it happens

Trigger: SetSystemConfig/SetSystemConfigKey with ADMIN_PASSWORD/admin_password whose value length is 0-3 characters.

Common situations: Automated provisioning scripts setting placeholder passwords like 'pw'; truncated values from env parsing; users intentionally choosing tiny test passwords.

Related errors

• admin username length must be between 4-32
• admin username can only contain letters, numbers and undersc
• configuration value too long, maximum 1024 characters
• Generate password md5-crypt failed: %w
• required column 'email' not found

AI-assisted analysis of Billionmail/BillionMail@fc36c76c05 (2026-09-05). Data as JSON: /api/errors/ae8cc8d1cbf9e8a3. Report an issue: GitHub.