What causes "password must not be empty" in usememos/memos?

Enforce a non-empty (ideally minimum-length) password in the client form before submit.

InvalidArgument

InvalidArgument

Error message

password must not be empty

What it means

validatePassword is the single guard for any user-management RPC that supplies a password (create user, update password). An empty password string is rejected as InvalidArgument before hashing or store access. There is deliberately no length/complexity rule here, only non-emptiness.

Source

Thrown at server/router/api/v1/user_service.go:27

	"strings"
	"time"

	"github.com/pkg/errors"
	"golang.org/x/crypto/bcrypt"
	"google.golang.org/grpc/codes"
	"google.golang.org/grpc/status"
	"google.golang.org/protobuf/types/known/emptypb"

	v1pb "github.com/usememos/memos/proto/gen/api/v1"
	storepb "github.com/usememos/memos/proto/gen/store"
	"github.com/usememos/memos/store"
)

const maxBatchGetUsers = 100

func validatePassword(password string) error {
	if password == "" {
		return errors.New("password must not be empty")
	}
	return nil
}

func validateUserTagsSetting(setting *v1pb.UserSetting_TagsSetting) error {
	if setting == nil {
		return errors.New("tags setting is required")
	}
	for tag, metadata := range setting.Tags {
		if strings.TrimSpace(tag) == "" {
			return errors.New("tag key cannot be empty")
		}
		if _, err := regexp.Compile(tag); err != nil {
			return errors.Wrapf(err, "tag key %q is not a valid regex pattern", tag)
		}
		if metadata == nil {
			return errors.Errorf("tag metadata is required for %q", tag)
		}

View on GitHub (pinned to 14d757ce1f)

Solutions

Enforce a non-empty (ideally minimum-length) password in the client form before submit.
For scripts, fail fast when the password variable is unset rather than sending ''.
For SSO/IdP-only accounts, use the IdP flow instead of local password fields.

Example fix

// before
await userClient.createUser({ user: { username, password: pw } }); // pw = ''

// after
if (!pw) throw new Error('Password is required');
await userClient.createUser({ user: { username, password: pw } });

Defensive patterns

Strategy: validation

Validate before calling

if (typeof password !== 'string' || password.length === 0) {
  throw new Error('Password is required');
}

Prevention

Mark password inputs required and validate before submit.
In provisioning scripts, fail fast on unset password variables instead of defaulting to ''.
Enforce a minimum length client-side; the server only checks non-emptiness.

When it happens

Trigger: CreateUser or UpdateUser with password = ''; SignUp with a sign-up form that did not enforce the field; password field omitted in a hand-written JSON body so it decodes to empty.

Common situations: Frontend form missing required validation on password; password managers failing to fill the field; admin provisioning scripts with an unset env var defaulting to ''.

Related errors

AI-assisted analysis of usememos/memos@14d757ce1f (2026-08-15). Data as JSON: /api/errors/7365e90fefa5fad4. Report an issue: GitHub.