diff --git a/auto_tests/encryptsave_test.c b/auto_tests/encryptsave_test.c
index b0828964..d187e352 100644
--- a/auto_tests/encryptsave_test.c
+++ b/auto_tests/encryptsave_test.c
@@ -164,6 +164,10 @@ START_TEST(test_keys)
     ck_assert_msg(ret, "generic failure 5: %u", decerr);
     ck_assert_msg(memcmp(out2, string, 44) == 0, "decryption 2 failed");
 
+    ret = tox_pass_decrypt(encrypted2, 44 + TOX_PASS_ENCRYPTION_EXTRA_LENGTH, NULL, 0, out2, &decerr);
+    ck_assert_msg(!ret, "Decrypt succeeded with wrong pass");
+    ck_assert_msg(decerr != TOX_ERR_DECRYPTION_FAILED, "Bad error code %u", decerr);
+
     // test that pass_decrypt can decrypt things from pass_key_encrypt
     ret = tox_pass_decrypt(encrypted, 44 + TOX_PASS_ENCRYPTION_EXTRA_LENGTH, "123qweasdzxc", 12, out1, &decerr);
     ck_assert_msg(ret, "generic failure 6: %u", decerr);
diff --git a/toxencryptsave/toxencryptsave.c b/toxencryptsave/toxencryptsave.c
index 162f530c..e6150ce2 100644
--- a/toxencryptsave/toxencryptsave.c
+++ b/toxencryptsave/toxencryptsave.c
@@ -96,7 +96,7 @@ bool tox_derive_key_from_pass(const uint8_t *passphrase, size_t pplength, TOX_PA
 bool tox_derive_key_with_salt(const uint8_t *passphrase, size_t pplength, const uint8_t *salt, TOX_PASS_KEY *out_key,
                               TOX_ERR_KEY_DERIVATION *error)
 {
-    if (pplength == 0 || !passphrase || !salt || !out_key) {
+    if (!salt || !out_key || (!passphrase && pplength != 0)) {
         SET_ERROR_PARAMETER(error, TOX_ERR_KEY_DERIVATION_NULL);
         return 0;
     }
@@ -255,7 +255,7 @@ bool tox_pass_key_decrypt(const uint8_t *data, size_t length, const TOX_PASS_KEY
 bool tox_pass_decrypt(const uint8_t *data, size_t length, const uint8_t *passphrase, size_t pplength, uint8_t *out,
                       TOX_ERR_DECRYPTION *error)
 {
-    if (length <= TOX_PASS_ENCRYPTION_EXTRA_LENGTH || pplength == 0) {
+    if (length <= TOX_PASS_ENCRYPTION_EXTRA_LENGTH) {
         SET_ERROR_PARAMETER(error, TOX_ERR_DECRYPTION_INVALID_LENGTH);
         return 0;
     }