Firebase Auth errorFirebase: “Password should be at least 6 characters” (auth/weak-password)

Why Firebase rejects the password, and the fix

1. 01

   The password is shorter than 6 characters

   “Thrown if the password is not strong enough.” Firebase, firebase.auth.Auth (createUserWithEmailAndPassword)

   Without a password policy, Firebase only checks length, and the minimum is 6. Add the same check to the sign-up form so the person sees the rule before they submit. In Flutter the code is weak-password, without the auth/ prefix.

   try {
     await createUserWithEmailAndPassword(auth, email, password);
   } catch (e) {
     if (e.code === 'auth/weak-password') {
       showMessage('Use at least 6 characters.');
     }
   }

2. 02

   A password policy is turned on

   “Require: Attempts to sign up fail until the user updates to a password that complies with your policy.” Firebase, Password authentication (Set a password policy)

   A project can require upper and lower case letters, a number, a symbol and a longer minimum. In Require mode, sign-up fails until the password meets every rule. Read the policy in the Firebase console and match the form to it.

3. 03

   Show which policy rule is missing

   “The password does not meet the requirements.” GitHub, firebase-js-sdk auth error messages

   validatePassword checks a password against the project’s policy on the client, so the form can tick off each rule as the person types. A policy failure comes back as auth/password-does-not-meet-requirements, not auth/weak-password, so catch both.

   import { getAuth, validatePassword } from 'firebase/auth';
   
   const status = await validatePassword(getAuth(), password);
   if (!status.isValid) {
     const needsNumber = status.containsNumericCharacter !== true;
     if (needsNumber) showMessage('Add a number.');
   }

4. 04

   Changing or resetting a password

   “Thrown if the new password is not strong enough.” Firebase, firebase.auth.Auth (confirmPasswordReset)

   updatePassword and confirmPasswordReset check the new password the same way. A reset page that skips the length check fails at the last step, after the person has already clicked the email link.

5. 05

   Creating users with the Admin SDK

   “The provided value for the password user property is invalid. It must be a string with at least six characters.” Firebase, Admin Authentication API errors (auth/invalid-password)

   On the server, createUser and updateUser reject a short password with auth/invalid-password rather than auth/weak-password.

Checked against the vendor’s docs on November 8, 2026: Firebase reference: firebase.auth.Auth error codes; Firebase docs: Password authentication (password policy); Firebase docs: Admin Authentication API errors; firebase-js-sdk: auth error messages.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

• from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
• from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.See scope and start

Related: Firebase auth/invalid-email · Firebase auth/email-already-in-use · Firebase auth/invalid-action-code · Firebase “FIS_AUTH_ERROR”