{"record":{"id":"cc23c17dff46c96b","repo":"strapi/strapi","slug":"invalid-password-expected-a-minimum-of-8-characte","errorCode":null,"errorMessage":"Invalid password. Expected a minimum of 8 characters with at least one number and one uppercase letter","messagePattern":"Invalid password\\. Expected a minimum of 8 characters with at least one number and one uppercase letter","errorType":"validation","errorClass":"ValidationError","httpStatus":400,"severity":"error","filePath":"packages/core/admin/server/src/services/user.ts","lineNumber":207,"sourceCode":"\n/**\n * Reset a user password by email. (Used in admin:reset CLI)\n * @param email - user email\n * @param password - new password\n */\nconst resetPasswordByEmail = async (email: string, password: string) => {\n  const user = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { email }, populate: ['roles'] });\n\n  if (!user) {\n    throw new Error(`User not found for email: ${email}`);\n  }\n\n  try {\n    await passwordValidator.validate(password);\n  } catch {\n    throw new ValidationError(\n      'Invalid password. Expected a minimum of 8 characters with at least one number and one uppercase letter'\n    );\n  }\n\n  await updateById(user.id, { password });\n};\n\n/**\n * Check if a user is the last super admin\n * @param userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: Data.ID): Promise<boolean> => {\n  const user = (await findOne(userId)) as AdminUser | null;\n  if (!user) return false;\n\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/strapi/strapi/blob/4a4101264d7098754df36e85fa629fd2f2349d8c/packages/core/admin/server/src/services/user.ts#L189-L225","documentation":"Thrown by resetPasswordByEmail when the provided password fails the passwordValidator (yup schema requiring >=8 chars, >=1 number, >=1 uppercase). The underlying yup error is swallowed and re-thrown as a ValidationError with a human-readable message. This runs after the user lookup succeeds, before updateById.","triggerScenarios":"Running admin:reset or calling resetPasswordByEmail with a password like 'password' (no uppercase/number), 'short' (too short), or 'abcdefgh' (no number/uppercase). Any value failing the min-8/number/uppercase rule.","commonSituations":"CLI password reset with a weak password. Automation script generating passwords without meeting the policy. User misunderstanding the policy requirements.","solutions":["Supply a password with at least 8 characters including at least one number and one uppercase letter (e.g. 'Strapi123').","If automating, validate against the same yup schema before calling reset."],"exampleFix":"// before\nawait strapi.service('admin::user').resetPasswordByEmail('a@b.com', 'password');\n// after\nawait strapi.service('admin::user').resetPasswordByEmail('a@b.com', 'Strapi123');","handlingStrategy":"validation","validationCode":"const ok = typeof password === 'string'\n  && password.length >= 8\n  && /[0-9]/.test(password)\n  && /[A-Z]/.test(password);\nif (!ok) throw new Error('Password must be >=8 chars with a number and an uppercase letter');","typeGuard":"const meetsPasswordPolicy = (p) => typeof p === 'string' && p.length >= 8 && /[0-9]/.test(p) && /[A-Z]/.test(p);","tryCatchPattern":null,"preventionTips":["Enforce the same policy in any UI or script that sets passwords.","When automating, generate compliant passwords (e.g. crypto output plus a digit/uppercase).","Validate before calling reset to avoid opaque server errors."],"tags":["users","password","validation","cli","admin"],"backgroundTag":null,"analyzedSha":"4a4101264d7098754df36e85fa629fd2f2349d8c","analyzedAt":"2026-08-12T12:47:50.760Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}