microsoft/garnet · error · ACLPasswordException

Unable to parse input password hash. The input is of wrong l

Error message

Unable to parse input password hash. The input is of wrong length.

What it means

Thrown by ACLPassword.ACLPasswordFromHash when the supplied hash string is not exactly 64 characters (2 * 32 bytes, since SHA-256 produces 32 bytes and each is 2 hex chars). A wrong-length input cannot represent a valid SHA-256 hash and is rejected with ACLPasswordException before any byte parsing.

Source

Thrown at libs/server/ACL/ACLPassword.cs:51

        /// <param name="password">Cleartext password used to initialize the password hash.</param>
        /// <returns>ACLPassword object for the given cleartext password.</returns>
        public static ACLPassword ACLPasswordFromString(string password)
        {
            byte[] hash = SHA256.HashData(Encoding.UTF8.GetBytes(password));
            return new ACLPassword(hash);
        }

        /// <summary>
        /// Initializes a new ACLPassword from the given string representation of a password hash.
        /// </summary>
        /// <param name="hashString">A hex-string containing a valid SHA-265 password hash.</param>
        /// <returns>ACLPassword object with the given hash.</returns>
        /// <exception cref="ACLPasswordException">Thrown when the given input string cannot be parsed.</exception>
        public static ACLPassword ACLPasswordFromHash(string hashString)
        {
            if (hashString.Length != 2 * NumHashBytes)
            {
                throw new ACLPasswordException("Unable to parse input password hash. The input is of wrong length.");
            }

            // Parse input byte by byte
            byte[] hash = new byte[NumHashBytes];
            try
            {
                for (int i = 0; i < hash.Length; i++)
                {
                    string byteString = hashString.Substring(i * 2, 2);
                    hash[i] = byte.Parse(byteString, NumberStyles.HexNumber, CultureInfo.InvariantCulture);
                }
            }
            catch (FormatException)
            {
                throw new ACLPasswordException("Unable to parse input password hash. The input is not of the correct format.");
            }

            return new ACLPassword(hash);

View on GitHub (pinned to 951b0fc683)

Solutions

1. Generate the hash with SHA-256 and output 64 hex characters (sha256sum, or SHA256.HashData then hex-encode).
2. Trim whitespace/newlines from the hash before passing.
3. If you have the cleartext, use ACLPassword.ACLPasswordFromString instead, which hashes for you.
4. Validate hashString.Length == 64 before calling.

Example fix

// before
var p = ACLPassword.ACLPasswordFromHash(sha1Hash); // 40 chars

// after
var p = ACLPassword.ACLPasswordFromHash(sha256Hex.Trim()); // 64 hex chars

if (hashString == null || hashString.Length != 64)
    throw new ArgumentException("Password hash must be exactly 64 hex characters (SHA-256).");

static bool IsCorrectHashLength(string s) => s != null && s.Length == 64;

try { var p = ACLPassword.ACLPasswordFromHash(hash); }
catch (ACLPasswordException ex) when (ex.Message.Contains("length")) { /* regenerate as SHA-256 */ }

When it happens

Trigger: Passing a hash that is too short (e.g. a 40-char SHA-1 hash) or too long (e.g. a 128-char SHA-512 hash, or 64 hex chars plus a trailing newline/space), or a raw password string mistaken for a hash.

Common situations: Using the output of sha1sum or sha512sum instead of sha256sum; copying a hash with a trailing newline from a shell; passing the base64 form; a truncated copy-paste.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Unable to parse input password hash. The input is not of the
• {exception.Message}
• Malformed ACL rule
• ACL rules need to start with the USER keyword
• {categoryName}

AI-assisted analysis of microsoft/garnet@951b0fc683 (2026-08-13). Data as JSON: /api/errors/43e4bbb585358ac8. Report an issue: GitHub.