phacility/phabricator · warning · PhabricatorAuthPasswordException

The selected password is too short. Passwords must be a mini

Error message

The selected password is too short. Passwords must be a minimum of %s characters long.

What it means

checkNewPassword() enforces the install-wide minimum length from the 'account.minimum-password-length' environment config: if the raw password is shorter than the configured value, this exception is thrown with 'Too Short' as the password field error. PhutilNumber formats the threshold so the message reads naturally in any locale.

Source

Thrown at src/applications/auth/engine/PhabricatorAuthPasswordEngine.php:80

    $raw_password = $password->openEnvelope();

    if (!strlen($raw_password)) {
      if ($can_skip) {
        throw new PhabricatorAuthPasswordException(
          pht('You must choose a password or skip this step.'),
          pht('Required'));
      } else {
        throw new PhabricatorAuthPasswordException(
          pht('You must choose a password.'),
          pht('Required'));
      }
    }

    $min_len = PhabricatorEnv::getEnvConfig('account.minimum-password-length');
    $min_len = (int)$min_len;
    if ($min_len) {
      if (strlen($raw_password) < $min_len) {
        throw new PhabricatorAuthPasswordException(
          pht(
            'The selected password is too short. Passwords must be a minimum '.
            'of %s characters long.',
            new PhutilNumber($min_len)),
          pht('Too Short'));
      }
    }

    $raw_confirm = $confirm->openEnvelope();

    if (!strlen($raw_confirm)) {
      throw new PhabricatorAuthPasswordException(
        pht('You must confirm the selected password.'),
        null,
        pht('Required'));
    }

    if ($raw_password !== $raw_confirm) {

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Choose a password at least as long as the configured minimum (the message states the exact number).
2. Check the current setting via PhabricatorEnv::getEnvConfig('account.minimum-password-length') if unsure.
3. In custom forms, pre-validate length client-side using the same config value.
4. Administrators can lower the config value if the policy is intentionally different for the install.

Example fix

// before: submit any short password and rely on the exception
$engine->checkNewPassword($password, $confirm);

// after: pre-validate against the same config the engine uses
$min_len = (int)PhabricatorEnv::getEnvConfig('account.minimum-password-length');
if (strlen($password->openEnvelope()) < $min_len) {
  // reject with a field error before calling the engine
}
$engine->checkNewPassword($password, $confirm);

// Same policy the engine enforces, checked up front
$min_len = (int)PhabricatorEnv::getEnvConfig('account.minimum-password-length');
if ($min_len && strlen($password->openEnvelope()) < $min_len) {
  $e_password = pht('Too Short');
  // reject before calling checkNewPassword()
}

try {
  $engine->checkNewPassword($password, $confirm);
} catch (PhabricatorAuthPasswordException $ex) {
  if ($ex->getPasswordError() === pht('Too Short')) {
    // show the configured minimum prominently in the form hint
  }
}

When it happens

Trigger: Submitting a password whose strlen() is below (int)PhabricatorEnv::getEnvConfig('account.minimum-password-length'), on any flow that uses the engine - registration, password change, reset, or admin-set-password.

Common situations: Admins raising the minimum after the fact so previously acceptable lengths now fail; users on mobile keyboards choosing short PINs; local dev installs copying production policy unexpectedly.

Related errors

• You must choose a password or skip this step.
• You must choose a password.
• You must confirm the selected password.
• The password and confirmation do not match.
• The selected password is very weak: it is one of the most co

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/c0249ae14c0be1ae. Report an issue: GitHub.