glanceapp/glance · error

the password for %s must be at least 6 characters

Error message

the password for %s must be at least 6 characters

What it means

A user's plaintext password is shorter than 6 characters. Glance enforces a minimum length on passwords supplied directly; password-hash entries bypass this because the original length is unknown.

Source

Thrown at internal/glance/config.go:476

	}

	for username := range config.Auth.Users {
		if username == "" {
			return fmt.Errorf("user has no name")
		}

		if len(username) < 3 {
			return errors.New("usernames must be at least 3 characters")
		}

		user := config.Auth.Users[username]

		if user.Password == "" {
			if user.PasswordHashString == "" {
				return fmt.Errorf("user %s must have a password or a password-hash set", username)
			}
		} else if len(user.Password) < 6 {
			return fmt.Errorf("the password for %s must be at least 6 characters", username)
		}
	}

	if config.Server.AssetsPath != "" {
		if _, err := os.Stat(config.Server.AssetsPath); os.IsNotExist(err) {
			return fmt.Errorf("assets directory does not exist: %s", config.Server.AssetsPath)
		}
	}

	for i := range config.Pages {
		page := &config.Pages[i]

		if page.Title == "" {
			return fmt.Errorf("page %d has no name", i+1)
		}

		if page.Width != "" && (page.Width != "wide" && page.Width != "slim" && page.Width != "default") {
			return fmt.Errorf("page %d: width can only be either wide or slim", i+1)

View on GitHub (pinned to 91324e8de7)

Solutions

1. Use a password of at least 6 characters for the user named in the message
2. If the password comes from an env variable, verify the variable's full value is exported
3. For short throwaway creds in testing, use a password-hash of the short secret instead — or better, use a long one

Example fix

# before
- username: alice
  password: abc
# after
- username: alice
  password: a-much-longer-secret

const minLen = 6
for name, u := range cfg.Auth.Users {
    if u.Password != "" && len(u.Password) < minLen {
        return fmt.Errorf("password for %s too short", name)
    }
}

When it happens

Trigger: Setting auth.users[].password to any string of length 1-5 during config validation. Empty passwords take the other branch (must have password or password-hash).

Common situations: Quick test credentials like 'a' or '1234' in a dev config; a truncated environment variable when using ${VAR} expansion; pasting a password and losing characters.

Related errors

• no pages configured
• secret-key must be set when users are configured
• user has no name
• user %s must have a password or a password-hash set
• page %d has no name

AI-assisted analysis of glanceapp/glance@91324e8de7 (2026-08-15). Data as JSON: /api/errors/1e7119867e55ebfa. Report an issue: GitHub.