{"record":{"id":"fe4a78037fcfb836","repo":"dgraph-io/dgraph","slug":"password-too-short-i-e-should-have-at-least-6-ch","errorCode":null,"errorMessage":"Password too short, i.e. should have at least 6 chars","messagePattern":"Password too short, i\\.e\\. should have at least 6 chars","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"types/password.go","lineNumber":20,"sourceCode":" * SPDX-FileCopyrightText: © 2017-2026 Istari Digital, Inc.\n * SPDX-License-Identifier: Apache-2.0\n */\n\npackage types\n\nimport (\n\t\"github.com/pkg/errors\"\n\t\"golang.org/x/crypto/bcrypt\"\n)\n\nconst (\n\tpwdLenLimit = 6\n)\n\n// Encrypt encrypts the given plain-text password.\nfunc Encrypt(plain string) (string, error) {\n\tif len(plain) < pwdLenLimit {\n\t\treturn \"\", errors.Errorf(\"Password too short, i.e. should have at least 6 chars\")\n\t}\n\n\tencrypted, err := bcrypt.GenerateFromPassword([]byte(plain), bcrypt.DefaultCost)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\treturn string(encrypted), nil\n}\n\n// VerifyPassword checks that the plain-text password matches the encrypted password.\nfunc VerifyPassword(plain, encrypted string) error {\n\tif len(plain) < pwdLenLimit || len(encrypted) == 0 {\n\t\treturn errors.Errorf(\"Invalid password/crypted string\")\n\t}\n\n\treturn bcrypt.CompareHashAndPassword([]byte(encrypted), []byte(plain))\n}","sourceCodeStart":2,"sourceCodeEnd":38,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/types/password.go#L2-L38","documentation":"Returned by types.Encrypt when the plain-text password passed for hashing is shorter than pwdLenLimit (6 characters). The input is rejected before bcrypt hashing because it would not meet the minimum length policy.","triggerScenarios":"Calling Encrypt with a string of length < 6, e.g. user-supplied passwords like 'abc' or '12345' passed to Convert or directly to Encrypt.","commonSituations":"Applications that do not enforce a minimum password length in their own signup validation, test fixtures with tiny passwords, or legacy data migration with weak passwords.","solutions":["Enforce a >=6 char password rule in application-level validation before calling Encrypt","Surface a clear message to the user asking for a longer password","If legacy short hashes must be supported, re-hash with a stronger password on next login"],"exampleFix":"// before\nhash, _ := types.Encrypt(\"abc\")\n// after\nif len(pwd) < 6 {\n    return errors.New(\"password must be at least 6 characters\")\n}\nhash, err := types.Encrypt(pwd)","handlingStrategy":"validation","validationCode":"if len(plain) < 6 {\n    return errors.New(\"password must be at least 6 characters\")\n}","typeGuard":null,"tryCatchPattern":"hash, err := types.Encrypt(pwd)\nif err != nil && strings.Contains(err.Error(), \"Password too short\") {\n    return fmt.Errorf(\"signup rejected: %w\", err)\n}","preventionTips":["Enforce the same minimum length in signup UI and server validation","Add tests covering the 5/6 char boundary","Never pre-truncate passwords before hashing"],"tags":["password","validation","bcrypt"],"backgroundTag":"password-too-short","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}