diff --git a/copyparty/httpcli.py b/copyparty/httpcli.py
index 0c17fa8b9..31d29f398 100644
--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
@@ -5471,7 +5471,7 @@ def tx_mounts(self) -> bool:
             no304vis=self.args.no304 > 0,
             msg=BADXFFB if hasattr(self, "bad_xff") else "",
             ver=S_VERSION if show_ver else "",
-            chpw=self.args.chpw and self.uname != "*",
+            chpw=self.args.chpw and self.uname != "*" and self.uname not in self.args.chpw_no,
             ahttps="" if self.is_https else "https://" + self.host + self.req,
         )
         self.reply(html.encode("utf-8"))
diff --git a/copyparty/web/splash.html b/copyparty/web/splash.html
index b57ff3f74..0a0120be1 100644
--- a/copyparty/web/splash.html
+++ b/copyparty/web/splash.html
@@ -213,6 +213,7 @@ <h1 id="cc">other stuff:</h1>
 	dfavico="{{ favico }}";
 
 var STG = window.localStorage;
+var chpw_min = {{ this.args.chpw_len }};
 document.documentElement.className = (STG && STG.cpp_thm) || "{{ this.args.theme }}";
 
 </script>
diff --git a/copyparty/web/splash.js b/copyparty/web/splash.js
index 4a70d0f45..a4dd61832 100644
--- a/copyparty/web/splash.js
+++ b/copyparty/web/splash.js
@@ -5,6 +5,7 @@ Ls.eng = {
 		"lo2": "ends the session on all browsers",
 		"u2": "time since the last server write$N( upload / rename / ... )$N$N17d = 17 days$N1h23 = 1 hour 23 minutes$N4m56 = 4 minutes 56 seconds",
 		"v2": "use this server as a local HDD",
+		"tan": "ERROR: New password has to be at least $N characters",
 		"ta1": "fill in your new password first",
 		"ta2": "repeat to confirm new password:",
 		"ta3": "found a typo; please try again",
@@ -103,6 +104,9 @@ if (/\&re=/.test('' + location))
 		if (!pwi.value)
 			return ebi('lm').innerHTML = d.ta1;
 
+		if (ebi('lp').value.length < chpw_min)
+			return ebi('lm').innerHTML = d.tan.replace('$N', chpw_min);
+
 		modal.prompt(d.ta2, "y", mok, null, stars);
 	};
 })();