{"record":{"id":"0fe557adfef765c3","repo":"louislam/uptime-kuma","slug":"passwordtooweak","errorCode":"passwordTooWeak","errorMessage":"passwordTooWeak","messagePattern":"passwordTooWeak","errorType":"validation","errorClass":"TranslatableError","httpStatus":null,"severity":"warning","filePath":"server/server.js","lineNumber":708,"sourceCode":"                        status: false,\n                    });\n                }\n            } catch (error) {\n                callback({\n                    ok: false,\n                    msg: error.message,\n                });\n            }\n        });\n\n        socket.on(\"needSetup\", async (callback) => {\n            callback(needSetup);\n        });\n\n        socket.on(\"setup\", async (username, password, callback) => {\n            try {\n                if (passwordStrength(password).value === \"Too weak\") {\n                    throw new TranslatableError(\"passwordTooWeak\");\n                }\n\n                if ((await R.knex(\"user\").count(\"id as count\").first()).count !== 0) {\n                    throw new Error(\n                        \"Uptime Kuma has been initialized. If you want to run setup again, please delete the database.\"\n                    );\n                }\n\n                let user = R.dispense(\"user\");\n                user.username = username;\n                user.password = await passwordHash.generate(password);\n                await R.store(user);\n\n                needSetup = false;\n\n                callback({\n                    ok: true,\n                    msg: \"successAdded\",","sourceCodeStart":690,"sourceCodeEnd":726,"githubUrl":"https://github.com/louislam/uptime-kuma/blob/6b5ea0155793e666666745fb8d6fef1e829543a2/server/server.js#L690-L726","documentation":"Thrown by the 'setup' socket handler when passwordStrength(password).value === 'Too weak' during initial admin creation. It is a TranslatableError carrying code 'passwordTooWeak' and msgi18n, so the client can localize it. The check runs before the 'already initialized' guard, so a weak password is rejected first.","triggerScenarios":"The first-time setup form is submitted with a password that the password-strength library rates 'Too weak' (short, common, low entropy). The callback returns {ok:false, msg:'passwordTooWeak', msgi18n:true}.","commonSituations":"Setting up Uptime Kuma with a trivial password like '123456' or 'admin'; password shorter than the library's minimum; running automated setup with a weak seeded password.","solutions":["Choose a longer, higher-entropy password (mix case, digits, symbols; 12+ characters).","Show the live password-strength meter in the setup UI and disable submit until it is not 'Too weak'.","For automated provisioning, generate a strong random password.","Pre-validate with the same password-strength library on the client before emitting 'setup'."],"exampleFix":"// before\nsocket.emit('setup', user, '123456', cb);\n\n// after\nconst pw = generateStrongPassword();\nif (passwordStrength(pw).value === 'Too weak') throw new Error('pick a stronger password');\nsocket.emit('setup', user, pw, cb);","handlingStrategy":"validation","validationCode":"// Mirror the server's strength check before submitting setup\nconst { default: strength } = await import('check-password-strength');\nif (strength(password).value === 'Too weak') {\n  return setError('Password is too weak; use a longer, mixed-character password.');\n}","typeGuard":"function isStrongEnough(password) {\n  // mirror the library's threshold used by the server\n  return typeof password === 'string' && password.length >= 8 && /[A-Z]/.test(password) && /[0-9]/.test(password);\n}","tryCatchPattern":null,"preventionTips":["Use a 12+ character password with mixed case, digits, and symbols.","Show a live strength meter and block submit while 'Too weak'.","For automation, generate a strong random password.","Validate strength on the client with the same library the server uses."],"tags":["auth","setup","password-policy","validation","i18n"],"backgroundTag":null,"analyzedSha":"6b5ea0155793e666666745fb8d6fef1e829543a2","analyzedAt":"2026-08-12T23:42:12.959Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}