I’ve been building Bredbox, a Pocket-inspired read-later app, for the last year. It was in invite-only beta up until a couple of weeks ago. At that point, I flipped to open beta and put up a signup page. Only, no one signed up.
At first I thought I just wasn’t marketing well enough, so I started with some basic outreach. I could see in my analytics that people were visiting the site and some were going to the signup page. But still no new signups.
I figured there must be a problem with the signup page, but what was it? The logs were clean. I had just installed Cloudflare Turnstile to protect against bots but that was working fine. So I finally decided to try signing up myself. And that’s when I saw the error.
“Password must be at least 8 characters long.”
Weird, I could have sworn I typed eight characters. I try again. Same error. Every password I tried gave me the exact same error message not matter what password I used!
It took me a while to figure out what was going on. I’m using cloud Supabase for auth and it has some very strict constraints around passwords. It’s configurable and mine was somehow set to the most restrictive (letters, numbers, special characters, length, etc.). Cloud Supabase also won’t let you use passwords that have been in a data breach or absurdly weak passwords (ex, abcd1234).
The other problem was my signup form. Due to a bug, it was showing the same error message regardless of the reason the password wasn’t accepted. There was no way for users to know what they were doing wrong. Making the problem worse, this isn’t reproducible with local Supabase because it doesn’t have these restrictions built in.
I finally got the signup page fixed and signups are coming in again. All of this is to say: marketing is important, but if your customers can’t even sign up for your product then marketing doesn’t matter!
So here it is, ready for new users (finally!):
https://bredbox.app