What causes "New passwords must be >= 24 digits." in nextcloud/all-in-one?

Choose a password of at least 24 ASCII alphanumeric characters (and spaces, the only other allowed chars).

nextcloud/all-in-one · warning · InvalidSettingConfigurationException

New passwords must be >= 24 digits.

Error message

New passwords must be >= 24 digits.

What it means

Thrown when the new master password is shorter than 24 characters (strlen check). Nextcloud AIO enforces a minimum length of 24 because this password protects the borg backup encryption key and the container's sudo-capable AIO user; shorter values are rejected before the charset check runs.

Source

Thrown at php/src/Data/ConfigurationManager.php:818

    /**
     * @throws InvalidSettingConfigurationException
     */
    public function changeMasterPassword(string $currentPassword, string $newPassword) : void {
        if ($currentPassword === '') {
            throw new InvalidSettingConfigurationException("Please enter your current password.");
        }

        if (!hash_equals($this->password, $currentPassword)) {
            throw new InvalidSettingConfigurationException("The entered current password is not correct.");
        }

        if ($newPassword === '') {
            throw new InvalidSettingConfigurationException("Please enter a new password.");
        }

        if (strlen($newPassword) < 24) {
            throw new InvalidSettingConfigurationException("New passwords must be >= 24 digits.");
        }

        if (!preg_match("#^[a-zA-Z0-9 ]+$#", $newPassword)) {
            throw new InvalidSettingConfigurationException('Not allowed characters in the new password.');
        }

        // All checks pass so set the password
        $this->set('password', $newPassword);
    }

    /**
     * @throws InvalidSettingConfigurationException
     */
    private function writeConfig() : void {
        if(!is_dir(DataConst::GetDataDirectory())) {
            throw new InvalidSettingConfigurationException(DataConst::GetDataDirectory() . " does not exist! Something was set up falsely!");
        }
        // Shouldn't happen, but as a precaution we won't write an empty config to disk.

View on GitHub (pinned to 6b788eec5e)

Solutions

Choose a password of at least 24 ASCII alphanumeric characters (and spaces, the only other allowed chars).
Generate one with a password manager, e.g. `openssl rand -base64 24 | tr -d '/+=' ` then keep only allowed characters.
If automating, add a client-side length check of >= 24 before submitting.

Example fix

// before
$newPassword = 'shortpw123';

// after
$newPassword = 'correct-horse-battery-9a7X'; // strlen >= 24, allowed charset

Defensive patterns

Strategy: validation

Validate before calling

if (strlen($newMasterPassword) < 24) {
    // reject before calling changeMasterPassword()
}

Prevention

Document the 24-character minimum wherever users pick the AIO master password.
Generate passwords with a manager and enforce >= 24 allowed characters upstream.

When it happens

Trigger: Calling changeMasterPassword() (or POSTing the master-password form) with a newPassword shorter than 24 bytes. Note the check uses strlen, so multibyte characters count per byte, not per character.

Common situations: Users pasting a typical 12-16 character password; assuming the usual 8-12 character minimum applies; counting Unicode characters (e.g. 25 emoji/accented chars that are fewer than 24 bytes).

Related errors

AI-assisted analysis of nextcloud/all-in-one@6b788eec5e (2026-08-21). Data as JSON: /api/errors/73f66233777c99ca. Report an issue: GitHub.