Budibase/budibase · error · HTTPError

Project package password is too long.

Error message

Project package password is too long.

What it means

When importing an encrypted project package, the supplied password is checked against MAX_ENCRYPT_PASSWORD_LENGTH (1024 characters, imports.ts:70). If encryptPassword.length exceeds that, extraction is refused up front with HTTP 400. It is a sanity limit on the password field, not a wrong-password error.

Source

Thrown at packages/server/src/sdk/workspace/projects/backups/imports.ts:921

  if (failedId) {
    throw new HTTPError(
      `Project import failed while saving '${failedId}'.`,
      400
    )
  }
}

async function extractProjectPackage(
  file: { path: string },
  encryptPassword?: string
): Promise<ExtractedProjectPackage> {
  const fileStats = await fsp.stat(file.path)
  if (fileStats.size > MAX_ARCHIVE_SIZE_BYTES) {
    throw new HTTPError("Project package is too large.", 400)
  }
  if (encryptPassword && encryptPassword.length > MAX_ENCRYPT_PASSWORD_LENGTH) {
    throw new HTTPError("Project package password is too long.", 400)
  }

  await validateProjectPackageBeforeExtraction(file)
  const tmpPath = await untarFile(file)
  try {
    if (encryptPassword) {
      try {
        await decryptFiles(tmpPath, encryptPassword)
      } catch {
        throw new HTTPError("Project package could not be decrypted.", 400)
      }
    }

    const packageFiles = await readDirectoryRecursively(tmpPath)
    const rootEntries = await fsp.readdir(tmpPath)
    if (rootEntries.some(entry => entry.endsWith(".enc")) && !encryptPassword) {
      throw new HTTPError(
        "Files are encrypted but no password has been supplied.",

View on GitHub (pinned to a81a902e9a)

Solutions

1. Re-run the import with the original password used at export time (it will be well under 1024 chars)
2. Check the client/CI configuration so the password field receives only the password, not a key file or wrapped secret
3. Trim stray whitespace/newlines that secret managers often append to injected values

Example fix

null

function validateEncryptPassword(password?: string): string | undefined {
  const MAX = 1024
  if (password && password.length > MAX) {
    throw new Error(`encryptPassword must be <= ${MAX} characters`)
  }
  return password?.trim() || undefined
}

function isValidPasswordLength(p: unknown): p is string {
  return typeof p === 'string' && p.length > 0 && p.length <= 1024
}

try {
  await importProjectPackage(file, password)
} catch (err) {
  if (err instanceof HTTPError && err.status === 400 && err.message === 'Project package password is too long.') {
    // fix the password source (config/CI secret) before retrying
  } else {
    throw err
  }
}

When it happens

Trigger: Passing an encryptPassword query/body parameter longer than 1024 characters to the project import endpoint, hitting the check at imports.ts:921 in extractProjectPackage().

Common situations: Accidentally passing a whole key/certificate or base64 blob as the password; a client bug concatenating values into the password field; misconfigured secret injection that appends newlines or multiple values.

Related errors

• Project package could not be decrypted.
• Invalid bookmark query
• Invalid limit query
• Limit query must be between 1 and 100
• Invalid ${queryName} query

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/7b664860f70d8718. Report an issue: GitHub.