{"id":"411acabda4d840d8","repo":"docker/cli","slug":"error-password-is-required","errorCode":null,"errorMessage":"error: password is required","messagePattern":"error: password is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/registry.go","lineNumber":180,"sourceCode":"\t\t\t\t//  e.g., 'run stty echo' when in a Linux or macOS shell, but\n\t\t\t\t//  PowerShell and CMD.exe may need different instructions.\n\t\t\t\t_, _ = fmt.Fprintln(cli.Err(), \"Error: failed to restore terminal state to echo input:\", err)\n\t\t\t}\n\t\t}()\n\n\t\tif serverAddress == authConfigKey {\n\t\t\tout := tui.NewOutput(cli.Err())\n\t\t\tout.PrintNote(\"A Personal Access Token (PAT) can be used instead.\\n\" +\n\t\t\t\t\"To create a PAT, visit \" + aec.Underline.Apply(\"https://app.docker.com/settings\") + \"\\n\\n\")\n\t\t}\n\n\t\targPassword, err = prompt.ReadInput(ctx, stdIn, cli.Out(), \"Password: \")\n\t\tif err != nil {\n\t\t\treturn registrytypes.AuthConfig{}, err\n\t\t}\n\t\t_, _ = fmt.Fprintln(cli.Out())\n\t\tif argPassword == \"\" {\n\t\t\treturn registrytypes.AuthConfig{}, errors.New(\"error: password is required\")\n\t\t}\n\t}\n\n\treturn registrytypes.AuthConfig{\n\t\tUsername:      argUser,\n\t\tPassword:      argPassword,\n\t\tServerAddress: serverAddress,\n\t}, nil\n}\n\n// RetrieveAuthTokenFromImage retrieves an encoded auth token given a\n// complete image reference. The auth configuration is serialized as a\n// base64url encoded ([RFC 4648, Section 5]) JSON string for sending through\n// the \"X-Registry-Auth\" header.\n//\n// [RFC 4648, Section 5]: https://tools.ietf.org/html/rfc4648#section-5\nfunc RetrieveAuthTokenFromImage(cfg *configfile.ConfigFile, image string) (string, error) {\n\tregistryRef, err := reference.ParseNormalizedNamed(image)","sourceCodeStart":162,"sourceCodeEnd":198,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/cli/command/registry.go#L162-L198","documentation":"Raised by PromptUserForCredentials (cli/command/registry.go:180) when the interactive Password prompt (with terminal echo disabled) returns an empty string. Unlike the username, there is no stored default for the password, so an empty entry immediately fails the login.","triggerScenarios":"Running `docker login` without -p/--password-stdin and pressing Enter at the Password prompt; piping input that supplies a username line but no password line, causing ReadInput to return empty.","commonSituations":"Users pasting a token that fails to paste into a no-echo terminal (some terminals block paste when echo is off); scripts feeding credentials via a heredoc that is missing the password line; confusion between password auth and token auth where the user expects a browser/device flow instead of a prompt.","solutions":["Enter the password or Personal Access Token at the prompt (input is hidden — it is being read even though nothing is displayed)","For non-interactive use, pipe the secret: echo \"$PASSWORD\" | docker login -u <user> --password-stdin","For Docker Hub, generate a PAT at https://app.docker.com/settings and use it in place of the account password"],"exampleFix":"# before\ndocker login\n# Password: <enter>\n# error: password is required\n\n# after\nprintf '%s' \"$DOCKER_PAT\" | docker login -u myuser --password-stdin","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":["docker-cli","registry","authentication","interactive-prompt"],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}