{"record":{"id":"78c03f24d610baed","repo":"phacility/phabricator","slug":"the-password-and-confirmation-do-not-match","errorCode":null,"errorMessage":"The password and confirmation do not match.","messagePattern":"The password and confirmation do not match\\.","errorType":"validation","errorClass":"PhabricatorAuthPasswordException","httpStatus":null,"severity":"warning","filePath":"src/applications/auth/engine/PhabricatorAuthPasswordEngine.php","lineNumber":99,"sourceCode":"          pht(\n            'The selected password is too short. Passwords must be a minimum '.\n            'of %s characters long.',\n            new PhutilNumber($min_len)),\n          pht('Too Short'));\n      }\n    }\n\n    $raw_confirm = $confirm->openEnvelope();\n\n    if (!strlen($raw_confirm)) {\n      throw new PhabricatorAuthPasswordException(\n        pht('You must confirm the selected password.'),\n        null,\n        pht('Required'));\n    }\n\n    if ($raw_password !== $raw_confirm) {\n      throw new PhabricatorAuthPasswordException(\n        pht('The password and confirmation do not match.'),\n        pht('Invalid'),\n        pht('Invalid'));\n    }\n\n    if (PhabricatorCommonPasswords::isCommonPassword($raw_password)) {\n      throw new PhabricatorAuthPasswordException(\n        pht(\n          'The selected password is very weak: it is one of the most common '.\n          'passwords in use. Choose a stronger password.'),\n        pht('Very Weak'));\n    }\n\n    // If we're creating a brand new object (like registering a new user)\n    // and it does not have a PHID yet, it isn't possible for it to have any\n    // revoked passwords or colliding passwords either, so we can skip these\n    // checks.\n","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/engine/PhabricatorAuthPasswordEngine.php#L81-L117","documentation":"The strict-comparison check in checkNewPassword(): when the raw password and raw confirmation differ (raw_password !== raw_confirm), both field errors are set to 'Invalid' (getPasswordError() and getConfirmError()), letting the UI mark both boxes. The comparison is byte-exact, not normalized.","triggerScenarios":"Any checkNewPassword() call where the two envelopes contain different strings - a typo in one field, trailing whitespace pasted into one box, or a mismatched caps-lock state.","commonSituations":"Users retyping rather than pasting; password managers inserting different entries into each field; leading/trailing space copied from a chat message; JavaScript-stripped whitespace on one field only.","solutions":["Re-enter the password and confirmation so they match exactly (watch for stray spaces).","In custom forms, compare the two raw values before submitting to give instant feedback.","Catch PhabricatorAuthPasswordException and render both getPasswordError() and getConfirmError()."],"exampleFix":"// before: submit directly to the engine\n$engine->checkNewPassword($password, $confirm);\n\n// after: pre-compare to avoid the round trip\nif ($password->openEnvelope() !== $confirm->openEnvelope()) {\n  // flag both fields client-side before calling the engine\n}\n$engine->checkNewPassword($password, $confirm);","handlingStrategy":"validation","validationCode":"// Cheap client-side pre-compare avoids the engine round trip\nif ($password->openEnvelope() !== $confirm->openEnvelope()) {\n  $e_password = pht('Invalid');\n  $e_confirm = pht('Invalid');\n  return $this->buildPasswordFormResponse($e_password, $e_confirm);\n}","typeGuard":null,"tryCatchPattern":"try {\n  $engine->checkNewPassword($password, $confirm);\n} catch (PhabricatorAuthPasswordException $ex) {\n  if ($ex->getPasswordError() === pht('Invalid') && $ex->getConfirmError() === pht('Invalid')) {\n    // mismatch: flag both fields\n  }\n}","preventionTips":["Compare the two raw values before submission for instant feedback.","Trim nothing - the engine compares byte-exact; educate users about stray whitespace.","Always decorate both fields using getPasswordError()/getConfirmError()."],"tags":["phabricator","password","validation","confirm-field","php"],"backgroundTag":"password-validation-failed","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}