diff --git src/wp-admin/install.php src/wp-admin/install.php
index d363e2d..de5bd4d 100644
--- src/wp-admin/install.php
+++ src/wp-admin/install.php
@@ -189,6 +189,7 @@ switch($step) {
 		$weblog_title = isset( $_POST['weblog_title'] ) ? trim( wp_unslash( $_POST['weblog_title'] ) ) : '';
 		$user_name = isset($_POST['user_name']) ? trim( wp_unslash( $_POST['user_name'] ) ) : '';
 		$admin_password = isset($_POST['admin_password']) ? wp_unslash( $_POST['admin_password'] ) : '';
+		$trimmed_admin_password = trim( $admin_password );
 		$admin_password_check = isset($_POST['admin_password2']) ? wp_unslash( $_POST['admin_password2'] ) : '';
 		$admin_email  = isset( $_POST['admin_email']  ) ?trim( wp_unslash( $_POST['admin_email'] ) ) : '';
 		$public       = isset( $_POST['blog_public']  ) ? (int) $_POST['blog_public'] : 0;
@@ -205,6 +206,10 @@ switch($step) {
 			// TODO: poka-yoke
 			display_setup_form( __( 'Your passwords do not match. Please try again.' ) );
 			$error = true;
+		} elseif ( !empty( $admin_password ) && empty( $trimmed_admin_password ) ) {
+			// TODO: poka-yoke
+			display_setup_form( __( 'Your password has nothing but whitespace. Please try again.' ) );
+			$error = true;
 		} else if ( empty( $admin_email ) ) {
 			// TODO: poka-yoke
 			display_setup_form( __( 'You must provide an email address.' ) );