phacility/phabricator · warning · PhabricatorAuthPasswordException

You must choose a password or skip this step.

Error message

You must choose a password or skip this step.

What it means

checkNewPassword() validates the primary password field first: if the raw password is empty and the caller passed can_skip=true (e.g., a registration or settings step where skipping is permitted), this exception tells the user they must either supply a password or explicitly skip. The second constructor argument ('Required') becomes getPasswordError(), which the UI attaches to the password form field.

Source

Thrown at src/applications/auth/engine/PhabricatorAuthPasswordEngine.php:66

  public function setUpgradeHashers($upgrade_hashers) {
    $this->upgradeHashers = $upgrade_hashers;
    return $this;
  }

  public function getUpgradeHashers() {
    return $this->upgradeHashers;
  }

  public function checkNewPassword(
    PhutilOpaqueEnvelope $password,
    PhutilOpaqueEnvelope $confirm,
    $can_skip = false) {

    $raw_password = $password->openEnvelope();

    if (!strlen($raw_password)) {
      if ($can_skip) {
        throw new PhabricatorAuthPasswordException(
          pht('You must choose a password or skip this step.'),
          pht('Required'));
      } else {
        throw new PhabricatorAuthPasswordException(
          pht('You must choose a password.'),
          pht('Required'));
      }
    }

    $min_len = PhabricatorEnv::getEnvConfig('account.minimum-password-length');
    $min_len = (int)$min_len;
    if ($min_len) {
      if (strlen($raw_password) < $min_len) {
        throw new PhabricatorAuthPasswordException(
          pht(
            'The selected password is too short. Passwords must be a minimum '.
            'of %s characters long.',
            new PhutilNumber($min_len)),

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Type a password, or use the form's explicit skip action instead of submitting an empty field.
2. If building a custom form, provide a separate skip control so users are not forced into the empty-submit path.
3. Catch PhabricatorAuthPasswordException and render getPasswordError() on the password field.

// Guard the explicit skip case before calling the engine
if (!strlen($password->openEnvelope())) {
  if (!$request->getBool('skipPassword')) {
    // render 'You must choose a password or skip this step.' yourself,
    // or provide the skip control
  }
}

try {
  $engine->checkNewPassword($password, $confirm, $can_skip = true);
} catch (PhabricatorAuthPasswordException $ex) {
  $e_password = $ex->getPasswordError(); // 'Required'
  return $this->newDialog()->addFormControl(/* ... */);
}

When it happens

Trigger: Submitting a password set/registration form with an empty password string while $can_skip is true - i.e., the caller wants skip to be an explicit choice rather than silently accepting a blank field.

Common situations: First-login/set-password flows where users leave the field blank and expect the form's 'skip' button/checkbox to be used; custom forms calling checkNewPassword($password, $confirm, true) without implementing the skip affordance.

Related errors

• You must choose a password.
• You must confirm the selected password.
• The selected password is too short. Passwords must be a mini
• The password and confirmation do not match.
• The selected password is very weak: it is one of the most co

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/2ccc2945123b7dd5. Report an issue: GitHub.