phalcon/cphalcon · error · WeakPassphrase

Invalid passphrase (too weak)

Error message

Invalid passphrase (too weak)

What it means

Error "Invalid passphrase (too weak)" thrown in phalcon/cphalcon.

Source

Thrown at phalcon/Encryption/Security/JWT/Builder.zep:400

            throw new InvalidNotBefore();
        }

        return this->setClaim(Enum::NOT_BEFORE, timestamp);
    }

    /**
     * @param string $passphrase
     *
     * @return static
     * @throws ValidatorException
     */
    public function setPassphrase( string passphrase) -> <static>
    {
        if !preg_match(
            "/^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[\W_]).{16,}$/",
            passphrase
        ) {
            throw new WeakPassphrase();
        }

        let this->passphrase = passphrase;

        return this;
    }

    /**
     * The "sub" (subject) claim identifies the principal that is the
     * subject of the JWT.  The claims in a JWT are normally statements
     * about the subject.  The subject value MUST either be scoped to be
     * locally unique in the context of the issuer or be globally unique.
     * The processing of this claim is generally application specific.  The
     * "sub" value is a case-sensitive string containing a StringOrURI
     * value.  Use of this claim is OPTIONAL.
     *
     * @param string $subject
     *

View on GitHub (pinned to b7419de9cd)

When it happens

Trigger: Thrown at phalcon/Encryption/Security/JWT/Builder.zep:400 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of phalcon/cphalcon@b7419de9cd (2026-08-21). Data as JSON: /api/errors/826ec3376eb26904. Report an issue: GitHub.