{"record":{"id":"c0249ae14c0be1ae","repo":"phacility/phabricator","slug":"the-selected-password-is-too-short-passwords-must","errorCode":null,"errorMessage":"The selected password is too short. Passwords must be a minimum of %s characters long.","messagePattern":"The selected password is too short\\. Passwords must be a minimum of (.+?) characters long\\.","errorType":"validation","errorClass":"PhabricatorAuthPasswordException","httpStatus":null,"severity":"warning","filePath":"src/applications/auth/engine/PhabricatorAuthPasswordEngine.php","lineNumber":80,"sourceCode":"    $raw_password = $password->openEnvelope();\n\n    if (!strlen($raw_password)) {\n      if ($can_skip) {\n        throw new PhabricatorAuthPasswordException(\n          pht('You must choose a password or skip this step.'),\n          pht('Required'));\n      } else {\n        throw new PhabricatorAuthPasswordException(\n          pht('You must choose a password.'),\n          pht('Required'));\n      }\n    }\n\n    $min_len = PhabricatorEnv::getEnvConfig('account.minimum-password-length');\n    $min_len = (int)$min_len;\n    if ($min_len) {\n      if (strlen($raw_password) < $min_len) {\n        throw new PhabricatorAuthPasswordException(\n          pht(\n            'The selected password is too short. Passwords must be a minimum '.\n            'of %s characters long.',\n            new PhutilNumber($min_len)),\n          pht('Too Short'));\n      }\n    }\n\n    $raw_confirm = $confirm->openEnvelope();\n\n    if (!strlen($raw_confirm)) {\n      throw new PhabricatorAuthPasswordException(\n        pht('You must confirm the selected password.'),\n        null,\n        pht('Required'));\n    }\n\n    if ($raw_password !== $raw_confirm) {","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/engine/PhabricatorAuthPasswordEngine.php#L62-L98","documentation":"checkNewPassword() enforces the install-wide minimum length from the 'account.minimum-password-length' environment config: if the raw password is shorter than the configured value, this exception is thrown with 'Too Short' as the password field error. PhutilNumber formats the threshold so the message reads naturally in any locale.","triggerScenarios":"Submitting a password whose strlen() is below (int)PhabricatorEnv::getEnvConfig('account.minimum-password-length'), on any flow that uses the engine - registration, password change, reset, or admin-set-password.","commonSituations":"Admins raising the minimum after the fact so previously acceptable lengths now fail; users on mobile keyboards choosing short PINs; local dev installs copying production policy unexpectedly.","solutions":["Choose a password at least as long as the configured minimum (the message states the exact number).","Check the current setting via PhabricatorEnv::getEnvConfig('account.minimum-password-length') if unsure.","In custom forms, pre-validate length client-side using the same config value.","Administrators can lower the config value if the policy is intentionally different for the install."],"exampleFix":"// before: submit any short password and rely on the exception\n$engine->checkNewPassword($password, $confirm);\n\n// after: pre-validate against the same config the engine uses\n$min_len = (int)PhabricatorEnv::getEnvConfig('account.minimum-password-length');\nif (strlen($password->openEnvelope()) < $min_len) {\n  // reject with a field error before calling the engine\n}\n$engine->checkNewPassword($password, $confirm);","handlingStrategy":"validation","validationCode":"// Same policy the engine enforces, checked up front\n$min_len = (int)PhabricatorEnv::getEnvConfig('account.minimum-password-length');\nif ($min_len && strlen($password->openEnvelope()) < $min_len) {\n  $e_password = pht('Too Short');\n  // reject before calling checkNewPassword()\n}","typeGuard":null,"tryCatchPattern":"try {\n  $engine->checkNewPassword($password, $confirm);\n} catch (PhabricatorAuthPasswordException $ex) {\n  if ($ex->getPasswordError() === pht('Too Short')) {\n    // show the configured minimum prominently in the form hint\n  }\n}","preventionTips":["Show the configured minimum length in the password form UI so users know the target.","Re-check local policy whenever 'account.minimum-password-length' changes.","Client-side length validation using the same config cuts round trips."],"tags":["phabricator","password","validation","minimum-length","php"],"backgroundTag":"password-validation-failed","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}