glanceapp/glance · error

hashing password for user %s: %v

Error message

hashing password for user %s: %v

What it means

Startup fails when bcrypt.GenerateFromPassword errors while hashing a user's plaintext password (config users with a plain `password` field, i.e. no pre-computed password-hash). bcrypt only errors when the password exceeds 72 bytes, so this almost always means a configured password longer than 72 characters.

Source

Thrown at internal/glance/glance.go:89

		app.usernameHashToUsername = make(map[string]string)
		app.failedAuthAttempts = make(map[string]*failedAuthAttempt)
		app.RequiresAuth = true

		for username := range config.Auth.Users {
			user := config.Auth.Users[username]
			usernameHash, err := computeUsernameHash(username, secretBytes)
			if err != nil {
				return nil, fmt.Errorf("computing username hash for user %s: %v", username, err)
			}
			app.usernameHashToUsername[string(usernameHash)] = username

			if user.PasswordHashString != "" {
				user.PasswordHash = []byte(user.PasswordHashString)
				user.PasswordHashString = ""
			} else {
				hashedPassword, err := bcrypt.GenerateFromPassword([]byte(user.Password), bcrypt.DefaultCost)
				if err != nil {
					return nil, fmt.Errorf("hashing password for user %s: %v", username, err)
				}

				user.Password = ""
				user.PasswordHash = hashedPassword
			}
		}

		app.authSecretKey = secretBytes
	}

	//
	// Init themes
	//

	if !config.Theme.DisablePicker {
		themeKeys := make([]string, 0, 2)
		themeProps := make([]*themeProperties, 0, 2)

View on GitHub (pinned to 91324e8de7)

Solutions

1. Shorten the user's password to 72 bytes or fewer
2. Better: pre-hash and supply `password-hash` instead of `password` (e.g. hash the long secret with sha256 first, then use that digest as the password, or store a bcrypt hash in password-hash)
3. Keep long secrets in a password manager and use a shorter typed password for glance

Example fix

# before
auth:
  users:
    admin:
      password: "<80+-character-passphrase>"
# after
auth:
  users:
    admin:
      password: "shorter-passphrase<=72-bytes"

// Enforce bcrypt's 72-byte limit before glance hashes
for name, u := range cfg.Auth.Users {
    if u.PasswordHashString == "" && len(u.Password) > 72 {
        return fmt.Errorf("user %s password exceeds 72 bytes", name)
    }
}

Catch at startup and point at the named user (the %s in the message); require a shorter password or a password-hash value — do not silently truncate.

When it happens

Trigger: A user entry in config.Auth.Users with a `password:` longer than 72 bytes and no `password-hash` field, causing bcrypt.GenerateFromPassword to return bcrypt.PasswordTooLongError (Go's x/crypto >= 0.x behavior).

Common situations: Pasting a long passphrase or a full base64/hex string as the login password; using machine-generated 128-char secrets as the glance login password.

Related errors

• decoding secret-key: %v
• secret-key must be exactly %d bytes
• computing username hash for user %s: %v
• initializing preset theme %s: %v
• initializing default theme: %v

AI-assisted analysis of glanceapp/glance@91324e8de7 (2026-08-15). Data as JSON: /api/errors/6f90f868427762a6. Report an issue: GitHub.