phacility/phabricator · warning · PhabricatorAuthPasswordException

You must confirm the selected password.

Error message

You must confirm the selected password.

What it means

After the password field passes its checks, checkNewPassword() opens the confirmation envelope; if the confirmation string is empty, this exception is thrown with null as the password error and 'Required' as the confirm error (getConfirmError()), so the UI can flag the confirmation field specifically.

Source

Thrown at src/applications/auth/engine/PhabricatorAuthPasswordEngine.php:92

    }

    $min_len = PhabricatorEnv::getEnvConfig('account.minimum-password-length');
    $min_len = (int)$min_len;
    if ($min_len) {
      if (strlen($raw_password) < $min_len) {
        throw new PhabricatorAuthPasswordException(
          pht(
            'The selected password is too short. Passwords must be a minimum '.
            'of %s characters long.',
            new PhutilNumber($min_len)),
          pht('Too Short'));
      }
    }

    $raw_confirm = $confirm->openEnvelope();

    if (!strlen($raw_confirm)) {
      throw new PhabricatorAuthPasswordException(
        pht('You must confirm the selected password.'),
        null,
        pht('Required'));
    }

    if ($raw_password !== $raw_confirm) {
      throw new PhabricatorAuthPasswordException(
        pht('The password and confirmation do not match.'),
        pht('Invalid'),
        pht('Invalid'));
    }

    if (PhabricatorCommonPasswords::isCommonPassword($raw_password)) {
      throw new PhabricatorAuthPasswordException(
        pht(
          'The selected password is very weak: it is one of the most common '.
          'passwords in use. Choose a stronger password.'),
        pht('Very Weak'));

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Fill in the confirmation field with the same password.
2. In custom flows, require the confirm input in the form definition before calling the engine.
3. Catch PhabricatorAuthPasswordException and use getConfirmError() to mark the confirmation field.

// Require the confirm field at the form layer
if (!strlen($confirm->openEnvelope())) {
  $e_confirm = pht('Required');
  return $this->buildPasswordFormResponse(null, $e_confirm);
}

try {
  $engine->checkNewPassword($password, $confirm);
} catch (PhabricatorAuthPasswordException $ex) {
  $e_confirm = $ex->getConfirmError(); // 'Required' when confirm is empty
  // re-render with the confirm field flagged
}

When it happens

Trigger: Submitting a password form where the confirm field was left blank while the password field was filled - any call to checkNewPassword($password, $confirm, ...) with an empty $confirm envelope.

Common situations: Forms where autofill fills only one field; browser extensions clearing the confirm box; users tabbing past the confirmation input; custom single-field forms that pass the same envelope but as an empty string.

Related errors

• You must choose a password or skip this step.
• You must choose a password.
• The password and confirmation do not match.
• The selected password is too short. Passwords must be a mini
• The selected password is very weak: it is one of the most co

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/dd453b9f7be0fb95. Report an issue: GitHub.