unslothai/unsloth · warning · HTTPException

New password cannot contain spaces

Error message

New password cannot contain spaces

What it means

/set-password-from-desktop rejects new passwords containing any whitespace character (checked via `any(ch.isspace() for ch in payload.new_password)`) with HTTP 400 'New password cannot contain spaces'. The rule covers all Unicode whitespace, not just the space character, because the bootstrap password is printed to a terminal and copied back — spaces break copy/paste round-trips.

Source

Thrown at studio/backend/routes/auth.py:572

            status_code = status.HTTP_403_FORBIDDEN,
            detail = "This action requires the Unsloth desktop app.",
        )

    record = storage.get_user_and_secret(current_subject)
    if record is None:
        raise HTTPException(
            status_code = status.HTTP_401_UNAUTHORIZED,
            detail = "User session is invalid",
        )

    _salt, pwd_hash, _jwt_secret, must_change_password = record
    if not must_change_password:
        raise HTTPException(
            status_code = status.HTTP_409_CONFLICT,
            detail = "A password is already set. Change it instead.",
        )
    if any(ch.isspace() for ch in payload.new_password):
        raise HTTPException(
            status_code = status.HTTP_400_BAD_REQUEST,
            detail = "New password cannot contain spaces",
        )

    # Conditional on the credential just read: a web password change or a
    # reset-password landing while this request is in flight must not be
    # overwritten by a caller that verified no password at all.
    new_secret = storage.update_password(
        current_subject,
        payload.new_password,
        revoke_refresh_tokens = True,
        expect_password_hash = pwd_hash,
        preserve_desktop_secret = True,
    )
    if new_secret is None:
        raise HTTPException(
            status_code = status.HTTP_409_CONFLICT,
            detail = "The password changed while this request was in flight. Try again.",

View on GitHub (pinned to 203007d190)

Solutions

1. Choose a password without whitespace, using hyphens or punctuation as separators
2. Strip leading/trailing whitespace client-side before submitting: `pw.strip()`
3. Validate with `''.join(ch for ch in pw if not ch.isspace())` or simply reject `any(ch.isspace() ...)` in the UI

Example fix

# before
body = {"new_password": "my passphrase 2026"}
# after
body = {"new_password": "my-passphrase-2026"}

def password_ok(pw: str) -> bool:
    return len(pw) > 0 and not any(ch.isspace() for ch in pw)

When it happens

Trigger: Submitting a new password containing spaces, tabs, newlines, or non-breaking spaces; pasting a password that picked up a trailing newline from the clipboard.

Common situations: Passphrase-style passwords with word separators; clipboard artifacts; input fields that do not trim.

Related errors

• New password must be different from the current password
• nonce must be base64url
• nonce must decode to 16-128 bytes
• Request failed (${status})
• family {getattr(fam, 'name', fam)!r} declares no prequant_fi

AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/de1836dbe362d6ae. Report an issue: GitHub.