# password_too_long

The new password has more characters than the deployment accepts (400).

## Meaning

A password was chosen that is longer than `auth.password.max_length`, counted in
characters after NFKC normalisation, on any path that sets one.

## Impact

Nothing was changed; a reset or invitation link stays unspent. It is rare, and
usually a pasted value that is not a password.

## Diagnosis

Look the request id up on the Troubleshooting page; the attempt is recorded with
reason `invalid_request` and cause `password_length`.

## Mitigation

- As a user: choose a shorter password.
- As an operator: `auth.password.max_length` sets the maximum, 128 by default and at
  most 1024.

## Escalation

Escalate when a password within `max_length` is refused. Open an issue with the
request id and the server version. Never attach the password.

---

[Problem code runbooks](https://www.nauthera.io/docs/v1/runbooks/problems) · Generated from [`internal/runbook/problems.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/problems.yaml) in nauthera-server.