What causes "Password too short, i.e. should have at least 6 chars" in dgraph-io/dgraph?

Enforce a >=6 char password rule in application-level validation before calling Encrypt

Password too short, i.e. should have at least 6 chars

Error message

Password too short, i.e. should have at least 6 chars

What it means

Returned by types.Encrypt when the plain-text password passed for hashing is shorter than pwdLenLimit (6 characters). The input is rejected before bcrypt hashing because it would not meet the minimum length policy.

Source

Thrown at types/password.go:20

 * SPDX-FileCopyrightText: © 2017-2026 Istari Digital, Inc.
 * SPDX-License-Identifier: Apache-2.0
 */

package types

import (
	"github.com/pkg/errors"
	"golang.org/x/crypto/bcrypt"
)

const (
	pwdLenLimit = 6
)

// Encrypt encrypts the given plain-text password.
func Encrypt(plain string) (string, error) {
	if len(plain) < pwdLenLimit {
		return "", errors.Errorf("Password too short, i.e. should have at least 6 chars")
	}

	encrypted, err := bcrypt.GenerateFromPassword([]byte(plain), bcrypt.DefaultCost)
	if err != nil {
		return "", err
	}

	return string(encrypted), nil
}

// VerifyPassword checks that the plain-text password matches the encrypted password.
func VerifyPassword(plain, encrypted string) error {
	if len(plain) < pwdLenLimit || len(encrypted) == 0 {
		return errors.Errorf("Invalid password/crypted string")
	}

	return bcrypt.CompareHashAndPassword([]byte(encrypted), []byte(plain))
}

View on GitHub (pinned to 759e242be6)

Solutions

Enforce a >=6 char password rule in application-level validation before calling Encrypt
Surface a clear message to the user asking for a longer password
If legacy short hashes must be supported, re-hash with a stronger password on next login

Example fix

// before
hash, _ := types.Encrypt("abc")
// after
if len(pwd) < 6 {
    return errors.New("password must be at least 6 characters")
}
hash, err := types.Encrypt(pwd)

Defensive patterns

Strategy: validation

Validate before calling

if len(plain) < 6 {
    return errors.New("password must be at least 6 characters")
}

Try / catch

hash, err := types.Encrypt(pwd)
if err != nil && strings.Contains(err.Error(), "Password too short") {
    return fmt.Errorf("signup rejected: %w", err)
}

Prevention

Enforce the same minimum length in signup UI and server validation
Add tests covering the 5/6 char boundary
Never pre-truncate passwords before hashing

When it happens

Trigger: Calling Encrypt with a string of length < 6, e.g. user-supplied passwords like 'abc' or '12345' passed to Convert or directly to Encrypt.

Common situations: Applications that do not enforce a minimum password length in their own signup validation, test fixtures with tiny passwords, or legacy data migration with weak passwords.

Related errors

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/fe4a78037fcfb836. Report an issue: GitHub.