schollz/croc · warning · Error

Code must be at least 6 characters

Error message

Code must be at least 6 characters

What it means

validateSecret rejects transfer codes shorter than 6 characters before any network activity starts. croc requires a minimum code entropy so the PAKE passphrase cannot be trivially brute-forced. It is called at the top of sendFiles and receive entry points, so it fails fast on user input.

Source

Thrown at web/src/protocol/client.ts:63

function abortError() {
  return new DOMException("Transfer cancelled", "AbortError");
}

function checkAbort(signal?: AbortSignal) {
  if (signal?.aborted) throw abortError();
}

function requirePakeVersion(version: number | undefined) {
  if (version !== PAKE_PROTOCOL_VERSION) {
    throw new Error(
      `Peer uses unsupported PAKE protocol version ${version ?? 0}; upgrade both croc clients`,
    );
  }
}

function validateSecret(secret: string) {
  if (secret.length < 6) throw new Error("Code must be at least 6 characters");
  if (!/^[\x20-\x7e]+$/.test(secret)) {
    throw new Error("Custom codes must use printable ASCII characters");
  }
}

function controlPort(relayAddress: string) {
  try {
    const parsed = new URL(
      relayAddress.includes("://") ? relayAddress : `tcp://${relayAddress}`,
    );
    return parsed.port || CONTROL_PORT;
  } catch {
    return CONTROL_PORT;
  }
}

function dataPorts(banner: string) {
  const ports = banner

View on GitHub (pinned to e25f1bdc04)

Solutions

1. Use a code of at least 6 characters, e.g. the generated 4-word croc code
2. Add a minlength/pattern check in the UI input so the user cannot submit early
3. Generate codes via wasm().codeComponents output rather than hand-writing them

Example fix

// before
await sendFiles({ files, secret: "abc", settings });

// after
await sendFiles({ files, secret: "sun-moth-table-7", settings });

// or guard in the UI:
// <input minlength={6} pattern="[ -~]{6,}" required />

function validSecret(s) {
  return typeof s === "string" && s.length >= 6;
}
if (!validSecret(secret)) throw new Error("Code must be at least 6 characters");

try { await sendFiles(opts); } catch (e) {
  if (e.message === "Code must be at least 6 characters") { setCodeError(e.message); return; }
  throw e;
}

When it happens

Trigger: Calling sendFiles with a user-typed custom code like 'abc'; receiving with a mistyped or truncated code phrase; an empty string passed programmatically.

Common situations: Users typing a short custom phrase instead of accepting the generated code; UI input that trims or drops characters (e.g. an autocomplete bug); test fixtures using placeholder secrets.

Related errors

• Custom codes must use printable ASCII characters
• Choose at least one file
• Duplicate filename: ${outgoingName}
• Received a file chunk outside the advertised file size
• Received more data than the advertised file size

AI-assisted analysis of schollz/croc@e25f1bdc04 (2026-08-15). Data as JSON: /api/errors/a7d80c67788f4100. Report an issue: GitHub.