docker/cli · error

error: password is required

Error message

error: password is required

What it means

Thrown by PromptUserForCredentials after the interactive password prompt (with echo disabled) returns an empty string. The login flow requires a non-empty password or token.

Solutions

1. Type your password or PAT at the prompt.
2. Use --password-stdin to pipe the credential from a file or env var.
3. Generate a PAT at https://app.docker.com/settings if unsure of the password.

Example fix

# before (pressing Enter at Password: prompt)
docker login -u myuser
# after
printf '%s' "$DOCKER_TOKEN" | docker login -u myuser --password-stdin

// Ensure a password/token is available before the prompt
if strings.TrimSpace(password) == "" {
    return fmt.Errorf("a password or PAT is required; use --password-stdin")
}

When it happens

Trigger: Interactive 'docker login' where the user presses Enter at the 'Password:' prompt without typing anything (registry.go lines 174-180).

Common situations: Accidental Enter; clipboard paste failure; using a PAT but pasting nothing.

Related errors

• error: username is required
• conflicting options: cannot specify both --password and…
• the --password-stdin option requires --username to be set
• username is empty
• password is empty

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/411acabda4d840d8. Report an issue: GitHub.

Appendix: source

Thrown at cli/command/registry.go:180

				//  e.g., 'run stty echo' when in a Linux or macOS shell, but
				//  PowerShell and CMD.exe may need different instructions.
				_, _ = fmt.Fprintln(cli.Err(), "Error: failed to restore terminal state to echo input:", err)
			}
		}()

		if serverAddress == authConfigKey {
			out := tui.NewOutput(cli.Err())
			out.PrintNote("A Personal Access Token (PAT) can be used instead.\n" +
				"To create a PAT, visit " + aec.Underline.Apply("https://app.docker.com/settings") + "\n\n")
		}

		argPassword, err = prompt.ReadInput(ctx, stdIn, cli.Out(), "Password: ")
		if err != nil {
			return registrytypes.AuthConfig{}, err
		}
		_, _ = fmt.Fprintln(cli.Out())
		if argPassword == "" {
			return registrytypes.AuthConfig{}, errors.New("error: password is required")
		}
	}

	return registrytypes.AuthConfig{
		Username:      argUser,
		Password:      argPassword,
		ServerAddress: serverAddress,
	}, nil
}

// RetrieveAuthTokenFromImage retrieves an encoded auth token given a
// complete image reference. The auth configuration is serialized as a
// base64url encoded ([RFC 4648, Section 5]) JSON string for sending through
// the "X-Registry-Auth" header.
//
// [RFC 4648, Section 5]: https://tools.ietf.org/html/rfc4648#section-5
func RetrieveAuthTokenFromImage(cfg *configfile.ConfigFile, image string) (string, error) {
	registryRef, err := reference.ParseNormalizedNamed(image)

View on GitHub (pinned to 4f84911bfe)