louislam/uptime-kuma · warning · TranslatableError

passwordTooWeak

passwordTooWeak

Error message

passwordTooWeak

What it means

Thrown by the 'setup' socket handler when passwordStrength(password).value === 'Too weak' during initial admin creation. It is a TranslatableError carrying code 'passwordTooWeak' and msgi18n, so the client can localize it. The check runs before the 'already initialized' guard, so a weak password is rejected first.

Source

Thrown at server/server.js:708

                        status: false,
                    });
                }
            } catch (error) {
                callback({
                    ok: false,
                    msg: error.message,
                });
            }
        });

        socket.on("needSetup", async (callback) => {
            callback(needSetup);
        });

        socket.on("setup", async (username, password, callback) => {
            try {
                if (passwordStrength(password).value === "Too weak") {
                    throw new TranslatableError("passwordTooWeak");
                }

                if ((await R.knex("user").count("id as count").first()).count !== 0) {
                    throw new Error(
                        "Uptime Kuma has been initialized. If you want to run setup again, please delete the database."
                    );
                }

                let user = R.dispense("user");
                user.username = username;
                user.password = await passwordHash.generate(password);
                await R.store(user);

                needSetup = false;

                callback({
                    ok: true,
                    msg: "successAdded",

View on GitHub (pinned to 6b5ea01557)

Solutions

1. Choose a longer, higher-entropy password (mix case, digits, symbols; 12+ characters).
2. Show the live password-strength meter in the setup UI and disable submit until it is not 'Too weak'.
3. For automated provisioning, generate a strong random password.
4. Pre-validate with the same password-strength library on the client before emitting 'setup'.

Example fix

// before
socket.emit('setup', user, '123456', cb);

// after
const pw = generateStrongPassword();
if (passwordStrength(pw).value === 'Too weak') throw new Error('pick a stronger password');
socket.emit('setup', user, pw, cb);

// Mirror the server's strength check before submitting setup
const { default: strength } = await import('check-password-strength');
if (strength(password).value === 'Too weak') {
  return setError('Password is too weak; use a longer, mixed-character password.');
}

function isStrongEnough(password) {
  // mirror the library's threshold used by the server
  return typeof password === 'string' && password.length >= 8 && /[A-Z]/.test(password) && /[0-9]/.test(password);
}

When it happens

Trigger: The first-time setup form is submitted with a password that the password-strength library rates 'Too weak' (short, common, low entropy). The callback returns {ok:false, msg:'passwordTooWeak', msgi18n:true}.

Common situations: Setting up Uptime Kuma with a trivial password like '123456' or 'admin'; password shorter than the library's minimum; running automated setup with a weak seeded password.

Related errors

• Uptime Kuma has been initialized. If you want to run setup a
• domain_expiry_unsupported_monitor_type
• domain_expiry_unsupported_is_icann
• domain_expiry_unsupported_unsupported_tld_no_rdap_endpoint
• Invalid new password

AI-assisted analysis of louislam/uptime-kuma@6b5ea01557 (2026-08-12). Data as JSON: /api/errors/0fe557adfef765c3. Report an issue: GitHub.