strapi/strapi · error · ValidationError

Invalid password. Expected a minimum of 8 characters with at

Error message

Invalid password. Expected a minimum of 8 characters with at least one number and one uppercase letter

What it means

Thrown by resetPasswordByEmail when the provided password fails the passwordValidator (yup schema requiring >=8 chars, >=1 number, >=1 uppercase). The underlying yup error is swallowed and re-thrown as a ValidationError with a human-readable message. This runs after the user lookup succeeds, before updateById.

Source

Thrown at packages/core/admin/server/src/services/user.ts:207

/**
 * Reset a user password by email. (Used in admin:reset CLI)
 * @param email - user email
 * @param password - new password
 */
const resetPasswordByEmail = async (email: string, password: string) => {
  const user = await strapi.db
    .query('admin::user')
    .findOne({ where: { email }, populate: ['roles'] });

  if (!user) {
    throw new Error(`User not found for email: ${email}`);
  }

  try {
    await passwordValidator.validate(password);
  } catch {
    throw new ValidationError(
      'Invalid password. Expected a minimum of 8 characters with at least one number and one uppercase letter'
    );
  }

  await updateById(user.id, { password });
};

/**
 * Check if a user is the last super admin
 * @param userId user's id to look for
 */
const isLastSuperAdminUser = async (userId: Data.ID): Promise<boolean> => {
  const user = (await findOne(userId)) as AdminUser | null;
  if (!user) return false;

  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();

  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);

View on GitHub (pinned to 4a4101264d)

Solutions

Supply a password with at least 8 characters including at least one number and one uppercase letter (e.g. 'Strapi123').
If automating, validate against the same yup schema before calling reset.

Example fix

// before
await strapi.service('admin::user').resetPasswordByEmail('a@b.com', 'password');
// after
await strapi.service('admin::user').resetPasswordByEmail('a@b.com', 'Strapi123');

Defensive patterns

Strategy: validation

Validate before calling

const ok = typeof password === 'string'
  && password.length >= 8
  && /[0-9]/.test(password)
  && /[A-Z]/.test(password);
if (!ok) throw new Error('Password must be >=8 chars with a number and an uppercase letter');

Type guard

const meetsPasswordPolicy = (p) => typeof p === 'string' && p.length >= 8 && /[0-9]/.test(p) && /[A-Z]/.test(p);

Prevention

Enforce the same policy in any UI or script that sets passwords.
When automating, generate compliant passwords (e.g. crypto output plus a digit/uppercase).
Validate before calling reset to avoid opaque server errors.

When it happens

Trigger: Running admin:reset or calling resetPasswordByEmail with a password like 'password' (no uppercase/number), 'short' (too short), or 'abcdefgh' (no number/uppercase). Any value failing the min-8/number/uppercase rule.

Common situations: CLI password reset with a weak password. Automation script generating passwords without meeting the policy. User misunderstanding the policy requirements.

Related errors

AI-assisted analysis of strapi/strapi@4a4101264d (2026-08-12). Data as JSON: /api/errors/cc23c17dff46c96b. Report an issue: GitHub.