How to fix weak_password: Password does not meet minimum requirements in Supabase

SupabaseBEGINNERMEDIUMUpdated Dec 29, 2025· 235 views

This error occurs when you attempt to create or update a user password in Supabase Auth that doesn't meet the configured password strength requirements. Your password may be too short, lack required character types, or be a known compromised password.

Quick fix

Fixes weak_password

const { data, error } = await supabase.auth.signUp({
  email: 'user@example.com',
  password: 'Tr0pical-Sunset#2024', // Strong password
});

if (error && error.code === 'weak_password') {
  console.error('Password too weak:', error.message);
  // Show user specific requirements from your Supabase settings
  // Password must be at least 8 characters
  // Password must include uppercase, lowercase, numbers, and symbols
}
  1. Check your Supabase password requirements
  2. Create a stronger password
  3. Update your sign-up code with stronger validation
  4. Check if password is in compromised databases
supabase — error
const { data, error } = await supabase.auth.signUp({
  email: 'user@example.com',
  password: 'Tr0pical-Sunset#2024', // Strong password
});
if (error && error.code === 'weak_password') {
  console.error('Password too weak:', error.message);
  // Show user specific requirements from your Supabase settings
  // Password must be at least 8 characters
  // Password must include uppercase, lowercase, numbers, and symbols
}
weak_password: Password does not meet minimum requirements

What this error means

Supabase Auth enforces password security policies to protect user accounts. When you call `signUp()` or `updateUser()` with a new password, Supabase validates it against configured requirements. The "weak_password" error is returned when the password fails one or more of these validation checks. The specific requirements can vary based on your Supabase project's authentication settings. Common validation rules include minimum length (default 6 characters, recommended 8+), required character types (uppercase, lowercase, numbers, special characters), and checks against known compromised passwords using the "Have I Been Pwned" database.

Typical symptoms

  • Sign up fails with 'weak_password' error when creating a new account
  • Password update fails when changing user password
  • Error message indicates password does not meet minimum requirements
  • User cannot complete authentication flow due to password rejection
  • Specific reasons provided: 'pwned' (compromised), 'length' (too short), or character requirements

Common causes

  1. Password is shorter than the minimum length requirement (default: 6 characters, but 8+ recommended)
  2. Password lacks required character types (e.g., no uppercase letters, numbers, or special characters)
  3. Password appears in the 'Have I Been Pwned' database of compromised passwords
  4. Password contains only common patterns that are easily guessable
  5. Your Supabase project has strict password security settings enabled

How to fix "weak_password: Password does not meet minimum requirements"

1Check your Supabase password requirements

Go to your Supabase dashboard and check the password policy settings:

1. Navigate to Authentication → Providers → Email
2. Scroll to Password Security section
3. Note the minimum length requirement
4. Check if character type requirements are enabled (uppercase, lowercase, numbers, symbols)
5. Check if 'Leaked password protection' is enabled

These settings determine what makes a password "weak" in your project. The default minimum is 6 characters, but Supabase recommends at least 8.

2Create a stronger password

Design a password that meets your project's requirements:

✓ At least 8 characters (or the minimum set in your project)
✓ Mix of uppercase and lowercase letters (e.g., MyPassword)
✓ Include at least one number (e.g., MyPassword123)
✓ Include a special character (if required by project settings)
✓ Avoid common patterns like "password123" or "admin123"
✓ Not previously compromised in data breaches

Good example: Tr0pical-Sunset#2024
Avoid: password123, admin, 12345678

3Update your sign-up code with stronger validation

Implement client-side password validation to catch weak passwords before sending to Supabase:

javascript
const { data, error } = await supabase.auth.signUp({
  email: 'user@example.com',
  password: 'Tr0pical-Sunset#2024', // Strong password
});

if (error && error.code === 'weak_password') {
  console.error('Password too weak:', error.message);
  // Show user specific requirements from your Supabase settings
  // Password must be at least 8 characters
  // Password must include uppercase, lowercase, numbers, and symbols
}
4Check if password is in compromised databases

If you see 'pwned' in the error reasons, your password appears in known data breaches:

javascript
if (error?.status === 422) {
  const weakReasons = error.message;
  if (weakReasons.includes('pwned')) {
    console.log('Password has been leaked in a previous breach');
    console.log('Choose a completely different password');
  }
}

Use [haveibeenpwned.com](https://haveibeenpwned.com) to check your password (without submitting it). The password is checked against their database, not shared with them.

5For development/testing: Disable strict password rules

If you're in a development environment and strict rules are slowing testing, you can relax requirements:

For cloud-hosted Supabase:
1. Go to Authentication → Providers → Email
2. Under Password Security, reduce minimum length or disable character requirements
3. Consider disabling 'Leaked password protection' for development-only projects

Important: Only do this in development. Always enable strict rules in production.

javascript
// Or in your development environment, use a simpler password
const devPassword = 'devpass123'; // 8+ chars, mixed case, numbers
6Validate password requirements in real-time

Show users password requirements as they type using a library like zxcvbn:

javascript
import zxcvbn from 'zxcvbn';

function validatePassword(password) {
  const result = zxcvbn(password);

  const meetsLength = password.length >= 8;
  const hasMixed = /[a-z]/.test(password) && /[A-Z]/.test(password);
  const hasNumber = /[0-9]/.test(password);
  const hasSpecial = /[!@#$%^&*()_+-=[]{};':"\|<>?,./]/.test(password);

  return {
    score: result.score, // 0-4
    meetsLength,
    hasMixed,
    hasNumber,
    hasSpecial,
  };
}

// Show user which requirements are met as they type
const validation = validatePassword(userInput);
console.log('Password strength:', validation.score);
console.log('Length OK:', validation.meetsLength);
console.log('Mixed case OK:', validation.hasMixed);

Advanced notes

Supabase uses the "Have I Been Pwned" API by default on Pro plans and above to prevent passwords that have appeared in public data breaches. This is a crucial security feature but can be disabled if needed in your project settings.

For self-hosted Supabase instances, you can customize password strength requirements by setting environment variables like GOTRUE_PASSWORD_MIN_LENGTH (default 6). Be cautious when weakening these rules—strong passwords are essential for account security.

The password is checked client-side against the Pwned Passwords API without revealing the full password. Only the first 5 characters of the SHA-1 hash are sent, maintaining privacy while preventing compromised passwords.

If your users consistently fail password validation, consider providing real-time feedback with a library like zxcvbn that shows password strength before submission, improving user experience while maintaining security.

Frequently asked questions

What does "weak_password" mean?
Supabase Auth enforces password security policies to protect user accounts. When you call signUp() or updateUser() with a new password, Supabase validates it against configured requirements. The "weak_password" error is returned when the password fails one or more of these validation checks.
How do I fix "weak_password"?
This error occurs when you attempt to create or update a user password in Supabase Auth that doesn't meet the configured password strength requirements. Your password may be too short, lack required character types, or be a known compromised password.
What causes "weak_password"?
Password is shorter than the minimum length requirement (default: 6 characters, but 8+ recommended) Password lacks required character types (e.g., no uppercase letters, numbers, or special characters) Password appears in the 'Have I Been Pwned' database of compromised passwords
Is the "weak_password" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading