phacility/phabricator · warning · PhabricatorAuthPasswordException

You must choose a password.

Error message

You must choose a password.

What it means

The non-skippable variant of the empty-password check in checkNewPassword(): the raw password is empty and $can_skip is false (e.g., password reset or mandatory change flows), so a password is simply required. 'Required' is exposed via getPasswordError() for form field decoration.

Source

Thrown at src/applications/auth/engine/PhabricatorAuthPasswordEngine.php:70

  public function getUpgradeHashers() {
    return $this->upgradeHashers;
  }

  public function checkNewPassword(
    PhutilOpaqueEnvelope $password,
    PhutilOpaqueEnvelope $confirm,
    $can_skip = false) {

    $raw_password = $password->openEnvelope();

    if (!strlen($raw_password)) {
      if ($can_skip) {
        throw new PhabricatorAuthPasswordException(
          pht('You must choose a password or skip this step.'),
          pht('Required'));
      } else {
        throw new PhabricatorAuthPasswordException(
          pht('You must choose a password.'),
          pht('Required'));
      }
    }

    $min_len = PhabricatorEnv::getEnvConfig('account.minimum-password-length');
    $min_len = (int)$min_len;
    if ($min_len) {
      if (strlen($raw_password) < $min_len) {
        throw new PhabricatorAuthPasswordException(
          pht(
            'The selected password is too short. Passwords must be a minimum '.
            'of %s characters long.',
            new PhutilNumber($min_len)),
          pht('Too Short'));
      }
    }

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Enter a non-empty password before submitting.
2. In API/CLI callers, validate strlen() on the raw input before invoking the engine.
3. Catch PhabricatorAuthPasswordException and map getPasswordError() ('Required') onto the password field.

// Reject an empty password before invoking the engine
if (!strlen($password->openEnvelope())) {
  $e_password = pht('Required');
  return $this->buildPasswordFormResponse($e_password);
}

try {
  $engine->checkNewPassword($password, $confirm);
} catch (PhabricatorAuthPasswordException $ex) {
  $e_password = $ex->getPasswordError(); // 'Required'
  // re-render the form with $e_password on the password field
}

When it happens

Trigger: Calling checkNewPassword($password, $confirm) (default $can_skip=false) or explicitly with false, where the password envelope opens to an empty string - blank submit on a mandatory password form.

Common situations: Password reset screens, admin-forced password changes, account minimum-policy enforcement, automated scripts passing an empty PhutilOpaqueEnvelope.

Related errors

• You must choose a password or skip this step.
• You must confirm the selected password.
• The selected password is too short. Passwords must be a mini
• The password and confirmation do not match.
• The selected password is very weak: it is one of the most co

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/b376320a9fd2165b. Report an issue: GitHub.