apache/answer · error

encrypt password failed: %w

Error message

encrypt password failed: %w

What it means

Fires in ResetPassword when bcrypt.GenerateFromPassword fails to hash the new password. With bcrypt and DefaultCost this practically only happens when the password exceeds bcrypt's 72-byte input limit, or on internal hash-cost errors; it is a guard around the crypto operation, at fault is the overly long password string.

Source

Thrown at internal/cli/reset_password.go:144

		printWarning("Passing password via command line may be recorded in shell history")
		if err := checker.CheckPassword(password); err != nil {
			return fmt.Errorf("password validation failed: %w", err)
		}
	} else {
		password, err = promptForPassword()
		if err != nil {
			return fmt.Errorf("password input failed: %w", err)
		}
	}

	if !confirmAction(fmt.Sprintf("This will reset password for user '[%s]%s'. Continue?", userInfo.DisplayName, email)) {
		fmt.Println("Operation cancelled")
		return nil
	}

	hashPwd, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
	if err != nil {
		return fmt.Errorf("encrypt password failed: %w", err)
	}

	if err = userRepo.UpdatePass(ctx, userInfo.ID, string(hashPwd)); err != nil {
		return fmt.Errorf("update password failed: %w", err)
	}

	authSvc.RemoveUserAllTokens(ctx, userInfo.ID)

	fmt.Printf("Password has been successfully updated for user: %s\n", email)
	fmt.Println("All login sessions have been cleared")

	return nil
}

// promptForPassword prompts for a password
func promptForPassword() (string, error) {
	for {
		input, err := getPasswordInput("Please input new password (empty to generate random password): ")

View on GitHub (pinned to 3b9f137061)

Solutions

1. Retry the operation; bcrypt.GenerateFromPassword rarely fails and a transient failure may not recur
2. Check available system memory and CPU; bcrypt allocation can fail under resource exhaustion
3. Verify the password string is valid UTF-8 and of reasonable length before hashing
4. Upgrade the bcrypt library if the failure persists with DefaultCost

When it happens

Trigger: Thrown at internal/cli/reset_password.go:144 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/answer@3b9f137061 (2026-09-05). Data as JSON: /api/errors/1d840eb5c9f51a28. Report an issue: GitHub.