What causes "Failed to hash password" in t8y2/dbx?

Use a reasonably sized DBX_PASSWORD (normal passphrase length); avoid multi-megabyte values.

Failed to hash password

Error message

Failed to hash password

What it means

Panics/aborts in dbx-web main when hashing the configured password (from DBX_PASSWORD or the database) fails — the password hashing routine (e.g. argon2/bcrypt setup) returned an error. This is an environment/parameter-level failure of the login credential setup, not a wrong password.

Source

Thrown at crates/dbx-web/src/main.rs:345

        Arc::new(AppState::new_with_plugin_and_agent_dir_and_app_version(
            storage,
            data_dir.join("plugins"),
            web_agent_dir(&data_dir),
            env!("CARGO_PKG_VERSION"),
        ))
    };

    // Password hash: env var takes priority, then database
    let password_disabled = std::env::var("DBX_DISABLE_PASSWORD")
        .map(|v| matches!(v.trim().to_lowercase().as_str(), "1" | "true" | "yes" | "on"))
        .unwrap_or(false);

    let password_hash = if password_disabled {
        None
    } else if let Ok(pw) = std::env::var("DBX_PASSWORD") {
        let salt = SaltString::generate(&mut OsRng);
        Some(Argon2::default().hash_password(pw.as_bytes(), &salt).expect("Failed to hash password").to_string())
    } else {
        app_state.storage.load_password_hash().await.unwrap_or(None)
    };

    let public_base_path = normalize_public_base_path(std::env::var("DBX_PUBLIC_BASE_PATH").ok());

    let web_state = Arc::new(WebState {
        app: app_state,
        data_dir,
        public_base_path: public_base_path.clone(),
        password_disabled,
        password_hash: RwLock::new(password_hash),
        sessions: RwLock::new(HashSet::new()),
        sse_channels: RwLock::new(HashMap::new()),
        transfer_progress_channels: RwLock::new(HashMap::new()),
        table_import_channels: RwLock::new(HashMap::new()),
        sql_file_executions: RwLock::new(HashMap::new()),
        nacos_imports: RwLock::new(HashMap::new()),

View on GitHub (pinned to c0390bff16)

Solutions

Use a reasonably sized DBX_PASSWORD (normal passphrase length); avoid multi-megabyte values.
Verify the env var actually contains the intended short password (echo ${#DBX_PASSWORD} to check length).
Handle the error gracefully: log and fall back to loading the stored hash or disabling auth instead of panicking.

Example fix

// before
Some(Argon2::default().hash_password(pw.as_bytes(), &salt).expect("Failed to hash password").to_string())
// after
match Argon2::default().hash_password(pw.as_bytes(), &salt) {
    Ok(hash) => Some(hash.to_string()),
    Err(e) => { eprintln!("Failed to hash password: {e}"); None }
}

Defensive patterns

Strategy: validation

Validate before calling

fn password_len_ok() -> bool {
    std::env::var("DBX_PASSWORD")
        .map(|pw| !pw.is_empty() && pw.len() <= 1024)
        .unwrap_or(true)
}

Try / catch

match std::env::var("DBX_PASSWORD") {
    Ok(pw) if !pw.is_empty() && pw.len() <= 1024 => match Argon2::default().hash_password(pw.as_bytes(), &salt) {
        Ok(h) => Some(h.to_string()),
        Err(e) => { eprintln!("Failed to hash password: {e}"); None }
    },
    _ => app_state.storage.load_password_hash().await.unwrap_or(None),
}

Prevention

Keep DBX_PASSWORD a normal-length secret (passphrase, not a file blob).
Do not pipe large files or base64 payloads into the env var.
Provide enough memory for Argon2's default cost parameters.

When it happens

Trigger: Argon2::default().hash_password(pw.as_bytes(), &salt) returns Err — practically only when the password exceeds Argon2's size limits or the allocator fails for the chosen memory cost parameters.

Common situations: Setting DBX_PASSWORD to an extremely large value (e.g., piping a huge file or base64 blob into the env var); running on a memory-constrained system where the Argon2 memory allocation fails.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/ed0cea3e464dee31. Report an issue: GitHub.