phacility/phabricator · warning · PhabricatorAuthPasswordException

The selected password is very weak: it is one of the most co

Error message

The selected password is very weak: it is one of the most common passwords in use. Choose a stronger password.

What it means

checkNewPassword() runs the raw password through PhabricatorCommonPasswords::isCommonPassword(), a curated blocklist of the most frequently used passwords (password, 123456, qwerty, ...). A match throws this exception with 'Very Weak' as the password field error, regardless of whether it satisfies the length policy.

Source

Thrown at src/applications/auth/engine/PhabricatorAuthPasswordEngine.php:106

    $raw_confirm = $confirm->openEnvelope();

    if (!strlen($raw_confirm)) {
      throw new PhabricatorAuthPasswordException(
        pht('You must confirm the selected password.'),
        null,
        pht('Required'));
    }

    if ($raw_password !== $raw_confirm) {
      throw new PhabricatorAuthPasswordException(
        pht('The password and confirmation do not match.'),
        pht('Invalid'),
        pht('Invalid'));
    }

    if (PhabricatorCommonPasswords::isCommonPassword($raw_password)) {
      throw new PhabricatorAuthPasswordException(
        pht(
          'The selected password is very weak: it is one of the most common '.
          'passwords in use. Choose a stronger password.'),
        pht('Very Weak'));
    }

    // If we're creating a brand new object (like registering a new user)
    // and it does not have a PHID yet, it isn't possible for it to have any
    // revoked passwords or colliding passwords either, so we can skip these
    // checks.

    $object = $this->getObject();

    if ($object->getPHID()) {
      if ($this->isRevokedPassword($password)) {
        throw new PhabricatorAuthPasswordException(
          pht(
            'The password you entered has been revoked. You can not reuse '.

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Choose a password that is not one of the well-known most common passwords - a generated passphrase or password manager output.
2. In tests and seeding scripts, use random strings rather than 'password'.
3. Optionally pre-check with PhabricatorCommonPasswords::isCommonPassword() before submitting.

Example fix

// before: seeded/test users use obvious passwords
$account->setPassword('password123', $engine);

// after: use generated values and pre-check the blocklist
$raw = Filesystem::readRandomCharacters(20);
if (PhabricatorCommonPasswords::isCommonPassword($raw)) {
  throw new Exception('unreachable, but keeps the invariant explicit');
}

// Pre-check the common-password blocklist
if (PhabricatorCommonPasswords::isCommonPassword($password->openEnvelope())) {
  $e_password = pht('Very Weak');
  return $this->buildPasswordFormResponse($e_password);
}

try {
  $engine->checkNewPassword($password, $confirm);
} catch (PhabricatorAuthPasswordException $ex) {
  if ($ex->getPasswordError() === pht('Very Weak')) {
    // prompt for a generated password / passphrase
  }
}

When it happens

Trigger: Any checkNewPassword() call (set password, register, reset) where the submitted password appears in the common-passwords list, even if it meets account.minimum-password-length.

Common situations: Users defaulting to 'password123' after a length policy is introduced; test accounts created with obvious passwords; dictionary-style passwords that appear in breach corpora.

Related errors

• The password you entered is very similar to a nonsecret acco
• You must choose a password or skip this step.
• You must choose a password.
• The selected password is too short. Passwords must be a mini
• You must confirm the selected password.

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/955b06ef15a4b767. Report an issue: GitHub.