makeplane / makeplane/plane

[bug]: Password complexity errors not displayed

Open
#8,082 2 comments 0 reactions 2 assignees View on GitHub

@vihar is already working on this.

Since Nov 7, 2025.

🐛bug
Dominant language
TypeScript
Stars
59.6k
Forks
5.8k
Avg merge
1d 22h
Merged PRs (30d)
49

Description

Is there an existing issue for this?
  • I have searched the existing issues
Current behavior

When I try and either set my initial password or when I try and change my password to certain passwords I get a toast popup at the bottom that has a title of auth.common.password.toast.error.title and a message of auth.common.password.toast.error.message. The actual message isn't shown on the screen.

After doing some digging it looks like there is a password complexity check in the API file:
apps/api/plane/authentication/views/common.py

I'm guessing this affects both the ChangePasswordEndpoint and SetUserPasswordEndpoint. The check is:

results = zxcvbn(new_password)
if results["score"] < 3:
    ...

This returns either an INVALID_NEW_PASSWORD or INVALID_PASSWORD but no user-friendly error message is being shown to the user.

Steps to reproduce
  1. Go the User Settings -> Security
  2. Change password
  3. Type in a password with a password complexity lower than 3

Or

  1. On initial user setup choose a low-complexity password for password and confirm password

A password that you can use to replicate this is: Say!hello1

It seems like it's complex enough to pass the frontend password weakness check but not complex enough to pass the backend zxcvbn check.

Environment

Production

Browser

Google Chrome

Variant

Self-hosted

Version

1.1.0

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.