invalid_password SCRAM authentication requires a non-empty password — 28P01

Symptoms

SCRAM authentication was attempted but the role has an empty password. PostgreSQL raises SQLSTATE 28P01 (invalid_password).

• The role has no usable password for SCRAM.
• Common after creating a role without a password.
• SCRAM cannot authenticate an empty password.

What the server log shows

FATAL:  SCRAM authentication requires a non-empty password

Why PostgreSQL raises this — what the manual says

As Section 20.5 Password Authentication explains:

SCRAM-SHA-256 authentication cannot proceed against an empty password, since there is no secret to derive the challenge-response from; set a non-empty password for the role (with ALTER ROLE … PASSWORD) before it can authenticate via SCRAM.

SCRAM-SHA-256 derives its proof from the role’s stored password verifier. A role with an empty/unset password has no verifier to authenticate against, so PostgreSQL rejects it with 28P01.

Common causes

• The role was created without a password.
• The password was reset to empty.
• Expecting trust/peer auth but the HBA line requires SCRAM.

How to fix it

1. Set a password: ALTER ROLE appuser PASSWORD 'strong-secret';.
2. Use an appropriate HBA method if password auth isn’t intended.
3. Ensure the password isn’t blank in the connection string.

Related & next steps

• SQLSTATE 28P01 — Invalid Password (full reference)
• Message: password authentication failed for user
• Glossary: SCRAM

Reference: PostgreSQL 18 Section 21.5 “Password Authentication”.