What's Password Criteria For Encryption Password On Backup Feature?

[IniBudi]

Hi, I would like to know about the password criteria for encryption passwords on the Cloudron backup feature.

Is it okay to use complex passwords like a combination of numbers, symbols, and Alphabet? Is it okay to use characters that are more than 30-100?

Thank you
Regards

[nebulon]

Currently the only checked restriction is, that it must be > eight characters https://git.cloudron.io/platform/box/-/blob/master/src/backups.js?ref_type=heads#L352

The password is then used to derive encryptions keys at https://git.cloudron.io/platform/box/-/blob/master/src/backups.js?ref_type=heads#L104

This means the caveats outlined by nodejs docs will apply also to Cloudron https://nodejs.org/api/crypto.html#using-strings-as-inputs-to-cryptographic-apis

[IniBudi]

Thank you for the clarification. So, I can use complex password for the encryption password.

[girish]

Yes, ultimately we use https://nodejs.org/api/crypto.html#cryptoscryptsyncpassword-salt-keylen-options to derive a key from the password . It has no length restrictions (per the docs).

[andreasdueren]

@IniBudi I'm using a * checks password manager * 128 character Passwort. I think yours will work too.