# password_too_short

The new password has fewer characters than the deployment accepts (400).

## Meaning

Registration, a reset or invitation link, or an administrator's create or password
set chose a password shorter than `auth.password.min_length`, counted in characters
after NFKC normalisation. The schema's own minimum is counted in bytes, so a
password of multi-byte characters can pass it and still be refused here.

## Impact

Nothing was changed; a reset or invitation link stays unspent. It is expected, and
the user only needs a longer password.

## Diagnosis

Look the request id up on the Troubleshooting page; the attempt is recorded on the
action that set the password with reason `invalid_request` and cause
`password_length`.

## Mitigation

- As a user: choose a longer password.
- As an operator: `auth.password.min_length` sets the minimum, at least 8.

## Escalation

Escalate when a password at least `min_length` characters long is refused. Open an
issue with the request id and the server version. Never attach the password.

---

[Problem code runbooks](https://www.nauthera.io/docs/v1/runbooks/problems) · Generated from [`internal/runbook/problems.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/problems.yaml) in nauthera-server.