jstedfast/MailKit · error · AuthenticationException

Password too long.

Error message

Password too long.

What it means

Like the username, the RFC 1929 password field is limited to 255 UTF-8 bytes. GetAuthenticateCommand throws AuthenticationException when the encoded password is too long; it zeroes the password buffer before throwing to avoid leaving the secret in memory.

Solutions

1. Set a password of 255 UTF-8 bytes or less for the SOCKS5 account
2. If a long secret must be sent, switch to a mechanism that supports it (e.g. tunnel auth at a higher layer) or a different proxy auth scheme
3. Validate credential byte lengths at configuration load time to fail fast with a clearer message

Example fix

// before
credentials.Password = File.ReadAllText("token.txt"); // 512-byte JWT
// after
credentials.Password = config["Socks5:Password"]; // <=255 bytes, set on the proxy server

if (Encoding.UTF8.GetByteCount(password) > 255)
    throw new ArgumentException("SOCKS5 password must be <= 255 UTF-8 bytes.", nameof(password));

When it happens

Trigger: Socks5Client.Connect/ConnectAsync with ProxyCredentials whose Password exceeds 255 UTF-8 bytes.

Common situations: Users pasting an access token or API key into the password field of a SOCKS5 credential, or very long generated passwords from a secret manager.

Related errors

• User name too long.
• Value cannot be null. (Parameter 'userName')
• Value cannot be null. (Parameter 'password')
• No credentials could be found for the IMAP server.
• No credentials could be found for the IMAP server.

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/c3dc694080706085. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Net/Proxy/Socks5Client.cs:248

			} while (n < 2);

			VerifySocksVersion (buffer[0]);

			return (Socks5AuthMethod) buffer[1];
		}

		byte[] GetAuthenticateCommand ()
		{
			var user = Encoding.UTF8.GetBytes (ProxyCredentials!.UserName);

			if (user.Length > 255)
				throw new AuthenticationException ("User name too long.");

			var passwd = Encoding.UTF8.GetBytes (ProxyCredentials.Password);

			if (passwd.Length > 255) {
				Array.Clear (passwd, 0, passwd.Length);
				throw new AuthenticationException ("Password too long.");
			}

			var buffer = new byte[user.Length + passwd.Length + 3];
			int n = 0;

			buffer[n++] = 1;
			buffer[n++] = (byte) user.Length;
			Buffer.BlockCopy (user, 0, buffer, n, user.Length);
			n += user.Length;
			buffer[n++] = (byte) passwd.Length;
			Buffer.BlockCopy (passwd, 0, buffer, n, passwd.Length);

			Array.Clear (passwd, 0, passwd.Length);

			return buffer;
		}

		void Authenticate (Socket socket, CancellationToken cancellationToken)

View on GitHub (pinned to 9d3859a785)