diff --git a/backend/src/Squidex.Domain.Users/PwnedPasswordValidator.cs b/backend/src/Squidex.Domain.Users/PwnedPasswordValidator.cs
index 9f34fdf65..ecd5125a6 100644
--- a/backend/src/Squidex.Domain.Users/PwnedPasswordValidator.cs
+++ b/backend/src/Squidex.Domain.Users/PwnedPasswordValidator.cs
@@ -29,6 +29,11 @@ namespace Squidex.Domain.Users
 
         public async Task<IdentityResult> ValidateAsync(UserManager<IdentityUser> manager, IdentityUser user, string password)
         {
+            if (string.IsNullOrWhiteSpace(password))
+            {
+                return IdentityResult.Success;
+            }
+
             try
             {
                 var isBreached = await client.IsPasswordPwned(password);