Mintplex-Labs/anything-llm · warning

Passwords do not match

Error message

Passwords do not match

What it means

Message 'Passwords do not match' from POST /system/reset-password, delivered as HTTP 500 via the endpoint's catch block. resetPassword throws this error when newPassword (after trimming) does not equal confirmPassword, and the catch converts the throw into {success:false, message:'Passwords do not match'} with a 500 status.

Source

Thrown at server/endpoints/system.js:438

    "/system/reset-password",
    [isMultiUserSetup],
    async (request, response) => {
      try {
        const { token, newPassword, confirmPassword } = reqBody(request);
        const { success, message, error } = await resetPassword(
          token,
          newPassword,
          confirmPassword
        );

        if (success) {
          response.status(200).json({ success, message });
        } else {
          response.status(400).json({ success, error });
        }
      } catch (error) {
        console.error("Error resetting password:", error);
        response.status(500).json({ success: false, message: error.message });
      }
    }
  );

  app.get(
    "/system/system-vectors",
    [validatedRequest, flexUserRoleValid([ROLES.admin, ROLES.manager])],
    async (request, response) => {
      try {
        const query = queryParams(request);
        const VectorDb = getVectorDbClass();
        const vectorCount = !!query.slug
          ? await VectorDb.namespaceCount(query.slug)
          : await VectorDb.totalVectors();
        response.status(200).json({ vectorCount });
      } catch (e) {
        console.error(e.message, e);
        response.sendStatus(500).end();

View on GitHub (pinned to 20f6d3546c)

Solutions

1. Send identical values in newPassword and confirmPassword (compare after applying the same trim to both on the client)
2. Disable autofill on the confirm field and clear stale values when the token changes
3. Branch on the message, not just the status — this 500 is a fixable client error, not a server fault

Example fix

// before
await api.post('/system/reset-password', {
  token, newPassword: 'NewPass123', confirmPassword: 'NewPass123 '
}); // 500 'Passwords do not match'

// after
const pw = newPassword.trim();
await api.post('/system/reset-password', {
  token, newPassword: pw, confirmPassword: pw
});

// Compare after applying identical normalization to both fields
const newPassword = String(rawNewPassword ?? '').trim();
const confirmPassword = String(rawConfirmPassword ?? '').trim();
if (!newPassword) throw new Error('New password is required');
if (newPassword !== confirmPassword) throw new Error('Passwords do not match');
await api.post('/system/reset-password', { token, newPassword, confirmPassword });

When it happens

Trigger: POST /system/reset-password where newPassword and confirmPassword differ — including trailing-space mismatches, since only newPassword is trimmed before the comparison while confirmPassword is stringified raw.

Common situations: Typo in one of the two fields; browser autofill filling only confirmPassword; client trimming one field but not the other before sending.

Related errors

• Invalid password.
• Failed to enable multi-user mode.
• click requires <x> <y> coordinates
• type requires <text> argument
• key requires <key> argument (e.g. Enter, Tab, Escape)

AI-assisted analysis of Mintplex-Labs/anything-llm@20f6d3546c (2026-08-18). Data as JSON: /api/errors/59d60ce33870ba11. Report an issue: GitHub.