# Enhance documentation for insecure-passwords and "invald" characters

**URL:** <https://discourse.haproxy.org/t/enhance-documentation-for-insecure-passwords-and-invald-characters/11959>\
**Category:** Help!\
**Created:** [August 8, 2025, 7:37am UTC](https://discourse.haproxy.org/t/enhance-documentation-for-insecure-passwords-and-invald-characters/11959 "2025-08-08T07:37:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pasche](https://avatars.discourse-cdn.com/v4/letter/p/ee7513/32.png) [@pasche](https://discourse.haproxy.org/u/pasche)\
**Post date:** [August 8, 2025, 7:37am UTC](https://discourse.haproxy.org/t/enhance-documentation-for-insecure-passwords-and-invald-characters/11959/1 "2025-08-08T07:37:15Z")

</div>

Hi community,

for some service, we are still using “basic auth”. As we noticed heavy CPU usage due to the used encryption method, we chose to switch that to “insecure-passwords”. But then, the password of a user did not work anymore.

This is caused by the password containing the “#” character in between. haproxy seems to treat this as a start of a comment at the end of a line while parsing the config file. So in that special case, the “valid” password was the string until the (first?) “#” character.

It would be good to either add a small hint to the “user” documentation or - if possible - to adjust the parsing (which could then allow to also accept “#” characters within passwords while using “insecure-password” option).

Thanks.

Robert

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [August 8, 2025, 7:58am UTC](https://discourse.haproxy.org/t/enhance-documentation-for-insecure-passwords-and-invald-characters/11959/2 "2025-08-08T07:58:03Z")

</div>

There is an entire section about this in the docs, see [2.2. Quoting and escaping](https://docs.haproxy.org/3.2/configuration.html#2.2).

Either escape the char or quote it with single quotes:

```
very\#secret\#pw
'very#secret#pw'

```

Single quoting all the `insecure-password` examples in the docs would probably be beneficial, I will send a patch for this.

---

<div class="post-metadata">

**Author:** ![pasche](https://avatars.discourse-cdn.com/v4/letter/p/ee7513/32.png) [@pasche](https://discourse.haproxy.org/u/pasche)\
**Post date:** [August 8, 2025, 8:34am UTC](https://discourse.haproxy.org/t/enhance-documentation-for-insecure-passwords-and-invald-characters/11959/3 "2025-08-08T08:34:57Z")

</div>

🤦‍♂️ Thank you very much for banging my head into this section. I’m currently dancing on too many parties that I did not “see” this.

Nothing more to be done. Topic closed.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [August 13, 2025, 9:57am UTC](https://discourse.haproxy.org/t/enhance-documentation-for-insecure-passwords-and-invald-characters/11959/4 "2025-08-13T09:57:46Z")

</div>

Nonetheless I have adjusted the doc examples and added a note:

> <https://github.com/haproxy/haproxy/commit/9432e7d6887ade0db69947f343c5b5535a33e303>
>
> Suggests single quoting passwords and update examples to avoid unexpected
> behavi…ors due to special characters.
> 
> Should be backported to stable versions.
> 
> Link: https://discourse.haproxy.org/t/enhance-documentation-for-insecure-passwords-and-invald-characters/11959