What causes "Specified password is too long" in kovidgoyal/kitty?

Use a password shorter than 1024 bytes

Specified password is too long

Error message

Specified password is too long

What it means

The password supplied to kitty @ (via --password, KITTY_PASSWORD, or the password prompt) exceeds 1024 bytes. kitty's remote-control encryption encrypts the password with the negotiated key and refuses oversized values.

Source

Thrown at tools/cmd/at/main.go:367

			} else {
				if errors.Is(err, os.ErrNotExist) {
					err = nil
				}
			}
		}
		if err != nil {
			return
		}
	}
	if !ans.is_set && password_env != "" {
		ans.val, ans.is_set = os.LookupEnv(password_env)
	}
	if !ans.is_set && use_password == "always" {
		ans.is_set = true
		return ans, nil
	}
	if len(ans.val) > 1024 {
		return ans, fmt.Errorf("Specified password is too long")
	}
	return ans, nil
}

var all_commands []func(*cli.Command) *cli.Command = make([]func(*cli.Command) *cli.Command, 0, 64)

func register_at_cmd(f func(*cli.Command) *cli.Command) {
	all_commands = append(all_commands, f)
}

func setup_global_options(cmd *cli.Command) (err error) {
	if global_options.already_setup {
		return nil
	}
	err = cmd.GetOptionValues(&rc_global_opts)
	if err != nil {
		return err
	}

View on GitHub (pinned to 6d5d0c4406)

Solutions

Use a password shorter than 1024 bytes
Check that you didn't accidentally pass a filename expecting it to be read, or a shell variable with extra content
If you need stronger auth, use a long random string under the limit or the socket-based auth instead

Defensive patterns

Strategy: validation

Validate before calling

if len(password) > 1024 { return errors.New("password too long") }

Type guard

func validRCPassword(p string) bool { return len(p) <= 1024 && p != "" }

Prevention

Use a concise random passphrase
Verify you're passing the password value, not a file's contents

When it happens

Trigger: get_password checks len(ans.val) > 1024 after assembling the password from flag/env/prompt and fails for longer values.

Common situations: Accidentally passing a file path's contents, a key from a password manager with metadata, a pasted multi-line blob, or a shell expansion gone wrong as the password.

Related errors

AI-assisted analysis of kovidgoyal/kitty@6d5d0c4406 (2026-08-27). Data as JSON: /api/errors/b8d2466bf8c625b9. Report an issue: GitHub.