louislam/dockge · error · Error

Password is too weak. It should contain alphabetic and numer

Error message

Password is too weak. It should contain alphabetic and numeric characters. It must be at least 6 characters in length.

What it means

During the 'setup' socket event, Dockge validates the admin password with the check-password-strength library. If the password scores 'Too weak' (default policy: too short or lacking alphabetic/numeric mix), the handler throws this Error before creating the initial user account. It is delivered to the client via the callback as {ok:false, msg}.

Source

Thrown at backend/socket-handlers/main-socket-handler.ts:35

} from "../util-server";
import { passwordStrength } from "check-password-strength";
import jwt from "jsonwebtoken";
import { Settings } from "../settings";
import fs, { promises as fsAsync } from "fs";
import path from "path";

export class MainSocketHandler extends SocketHandler {
    create(socket : DockgeSocket, server : DockgeServer) {

        // ***************************
        // Public Socket API
        // ***************************

        // Setup
        socket.on("setup", async (username, password, callback) => {
            try {
                if (passwordStrength(password).value === "Too weak") {
                    throw new Error("Password is too weak. It should contain alphabetic and numeric characters. It must be at least 6 characters in length.");
                }

                if ((await R.knex("user").count("id as count").first()).count !== 0) {
                    throw new Error("Dockge has been initialized. If you want to run setup again, please delete the database.");
                }

                const user = R.dispense("user");
                user.username = username;
                user.password = generatePasswordHash(password);
                await R.store(user);

                server.needSetup = false;

                callback({
                    ok: true,
                    msg: "successAdded",
                    msgi18n: true,
                });

View on GitHub (pinned to f809ae192b)

Solutions

1. Choose a password of at least 6 characters containing both alphabetic and numeric characters.
2. Check passwordStrength(password).value client-side before emitting the 'setup' event.
3. Retry the setup call with a stronger password; the error is returned via callback and the user is not created.

Example fix

// before
socket.emit('setup', 'admin', '12345', callback);
// after
const pwd = 'dockge123';
if (passwordStrength(pwd).value !== 'Too weak') {
    socket.emit('setup', 'admin', pwd, callback);
}

import { passwordStrength } from 'check-password-strength';
function isAcceptablePassword(pwd) {
    return typeof pwd === 'string' && passwordStrength(pwd).value !== 'Too weak';
}

function isNonEmptyString(v) { return typeof v === 'string' && v.length >= 6; }

socket.emit('setup', username, password, (res) => {
    if (!res.ok && res.msg.includes('too weak')) {
        promptForStrongerPassword();
    }
});

When it happens

Trigger: Calling the 'setup' socket event with a password that check-password-strength rates 'Too weak' — e.g. fewer than 6 characters, or only letters / only digits with no mix.

Common situations: First-run initialization of a Dockge instance where the admin enters a short or single-character-class password; automated setup scripts posting weak default credentials; UIs not enforcing client-side strength checks before emitting 'setup'.

Related errors

• Invalid new password
• Dockge has been initialized. If you want to run setup again,
• Wrong data type?
• Incorrect current password
• Name must be a string

AI-assisted analysis of louislam/dockge@f809ae192b (2026-08-31). Data as JSON: /api/errors/6a10584ac3c003ed. Report an issue: GitHub.