{"record":{"id":"955b06ef15a4b767","repo":"phacility/phabricator","slug":"the-selected-password-is-very-weak-it-is-one-of-t","errorCode":null,"errorMessage":"The selected password is very weak: it is one of the most common passwords in use. Choose a stronger password.","messagePattern":"The selected password is very weak: it is one of the most common passwords in use\\. Choose a stronger password\\.","errorType":"validation","errorClass":"PhabricatorAuthPasswordException","httpStatus":null,"severity":"warning","filePath":"src/applications/auth/engine/PhabricatorAuthPasswordEngine.php","lineNumber":106,"sourceCode":"\n    $raw_confirm = $confirm->openEnvelope();\n\n    if (!strlen($raw_confirm)) {\n      throw new PhabricatorAuthPasswordException(\n        pht('You must confirm the selected password.'),\n        null,\n        pht('Required'));\n    }\n\n    if ($raw_password !== $raw_confirm) {\n      throw new PhabricatorAuthPasswordException(\n        pht('The password and confirmation do not match.'),\n        pht('Invalid'),\n        pht('Invalid'));\n    }\n\n    if (PhabricatorCommonPasswords::isCommonPassword($raw_password)) {\n      throw new PhabricatorAuthPasswordException(\n        pht(\n          'The selected password is very weak: it is one of the most common '.\n          'passwords in use. Choose a stronger password.'),\n        pht('Very Weak'));\n    }\n\n    // If we're creating a brand new object (like registering a new user)\n    // and it does not have a PHID yet, it isn't possible for it to have any\n    // revoked passwords or colliding passwords either, so we can skip these\n    // checks.\n\n    $object = $this->getObject();\n\n    if ($object->getPHID()) {\n      if ($this->isRevokedPassword($password)) {\n        throw new PhabricatorAuthPasswordException(\n          pht(\n            'The password you entered has been revoked. You can not reuse '.","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/engine/PhabricatorAuthPasswordEngine.php#L88-L124","documentation":"checkNewPassword() runs the raw password through PhabricatorCommonPasswords::isCommonPassword(), a curated blocklist of the most frequently used passwords (password, 123456, qwerty, ...). A match throws this exception with 'Very Weak' as the password field error, regardless of whether it satisfies the length policy.","triggerScenarios":"Any checkNewPassword() call (set password, register, reset) where the submitted password appears in the common-passwords list, even if it meets account.minimum-password-length.","commonSituations":"Users defaulting to 'password123' after a length policy is introduced; test accounts created with obvious passwords; dictionary-style passwords that appear in breach corpora.","solutions":["Choose a password that is not one of the well-known most common passwords - a generated passphrase or password manager output.","In tests and seeding scripts, use random strings rather than 'password'.","Optionally pre-check with PhabricatorCommonPasswords::isCommonPassword() before submitting."],"exampleFix":"// before: seeded/test users use obvious passwords\n$account->setPassword('password123', $engine);\n\n// after: use generated values and pre-check the blocklist\n$raw = Filesystem::readRandomCharacters(20);\nif (PhabricatorCommonPasswords::isCommonPassword($raw)) {\n  throw new Exception('unreachable, but keeps the invariant explicit');\n}","handlingStrategy":"validation","validationCode":"// Pre-check the common-password blocklist\nif (PhabricatorCommonPasswords::isCommonPassword($password->openEnvelope())) {\n  $e_password = pht('Very Weak');\n  return $this->buildPasswordFormResponse($e_password);\n}","typeGuard":null,"tryCatchPattern":"try {\n  $engine->checkNewPassword($password, $confirm);\n} catch (PhabricatorAuthPasswordException $ex) {\n  if ($ex->getPasswordError() === pht('Very Weak')) {\n    // prompt for a generated password / passphrase\n  }\n}","preventionTips":["Never seed test or admin accounts with dictionary passwords.","Offer a generated-password affordance near the field to steer users away from common values.","Re-use PhabricatorCommonPasswords::isCommonPassword() in your own pre-checks."],"tags":["phabricator","password","validation","weak-password","php"],"backgroundTag":"password-validation-failed","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}