dgraph-io/dgraph · error

Invalid password/crypted string

Error message

Invalid password/crypted string

What it means

Thrown by VerifyPassword when inputs are unusable: the plain password is shorter than 6 characters or the encrypted (bcrypt hash) string is empty. It guards bcrypt.CompareHashAndPassword from being called with degenerate inputs.

Source

Thrown at types/password.go:34

// Encrypt encrypts the given plain-text password.
func Encrypt(plain string) (string, error) {
	if len(plain) < pwdLenLimit {
		return "", errors.Errorf("Password too short, i.e. should have at least 6 chars")
	}

	encrypted, err := bcrypt.GenerateFromPassword([]byte(plain), bcrypt.DefaultCost)
	if err != nil {
		return "", err
	}

	return string(encrypted), nil
}

// VerifyPassword checks that the plain-text password matches the encrypted password.
func VerifyPassword(plain, encrypted string) error {
	if len(plain) < pwdLenLimit || len(encrypted) == 0 {
		return errors.Errorf("Invalid password/crypted string")
	}

	return bcrypt.CompareHashAndPassword([]byte(encrypted), []byte(plain))
}

View on GitHub (pinned to 759e242be6)

Solutions

1. Check that the stored hash is non-empty before calling VerifyPassword and route to a 'no password set' flow otherwise
2. Enforce the same 6-char minimum at login/signup so plain input never fails here
3. Treat this error as an invalid-credential condition and re-hash/repair records with missing hashes

Example fix

// before
err := types.VerifyPassword(plain, storedHash) // storedHash may be ""
// after
if storedHash == "" {
    return ErrNoPasswordSet
}
if len(plain) < 6 {
    return ErrInvalidCredentials
}
err := types.VerifyPassword(plain, storedHash)

if len(plain) < 6 {
    return errors.New("password too short")
}
if len(encrypted) == 0 {
    return errors.New("no password stored for this account")
}

if err := types.VerifyPassword(plain, stored); err != nil {
    // uniform response: ErrInvalidCredentials (do not leak whether hash was empty)
    return ErrInvalidCredentials
}

When it happens

Trigger: Calling VerifyPassword with a <6 char plain password, or with an empty encrypted value — typically when the stored hash is missing, the DB column is empty, or a record was created without a password.

Common situations: Users whose account record has no stored hash (e.g. OAuth-only accounts) attempting password login; truncated or reset password columns; checking a short password.

Related errors

• Password too short, i.e. should have at least 6 chars
• the two typed passwords do not match
• NQuad failed sanity check. Subject: %q, Predicate: %q, Objec
• empty variable name in function call
• empty facetKeys not allowed

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/c9dbcdccef31bbba. Report an issue: GitHub.