diff --git a/crates/shadowsocks/src/config.rs b/crates/shadowsocks/src/config.rs
index 4caa10b9..c16396e7 100644
--- a/crates/shadowsocks/src/config.rs
+++ b/crates/shadowsocks/src/config.rs
@@ -16,7 +16,7 @@ use base64::Engine as _;
 use byte_string::ByteStr;
 use bytes::Bytes;
 use cfg_if::cfg_if;
-use log::error;
+use log::{error, warn};
 use thiserror::Error;
 use url::{self, Url};
 
@@ -482,12 +482,28 @@ where
 {
     let password = password.into();
 
-    #[cfg(feature = "stream-cipher")]
-    if method == CipherKind::SS_TABLE {
-        // TABLE cipher doesn't need key derivation.
-        // Reference implemenation: shadowsocks-libev, shadowsocks (Python)
-        let enc_key = password.clone().into_bytes().into_boxed_slice();
-        return (password, enc_key, Vec::new());
+    match method {
+        CipherKind::NONE => {
+            // NONE method's key length is 0
+            debug_assert_eq!(method.key_len(), 0);
+
+            if !password.is_empty() {
+                warn!("method \"none\" doesn't need a password, which should be set as an empty String, but password.len() = {}", password.len());
+            }
+
+            return (password, Vec::new().into_boxed_slice(), Vec::new());
+        }
+
+        #[cfg(feature = "stream-cipher")]
+        CipherKind::SS_TABLE => {
+            // TABLE cipher doesn't need key derivation.
+            // Reference implemenation: shadowsocks-libev, shadowsocks (Python)
+            let enc_key = password.clone().into_bytes().into_boxed_slice();
+            return (password, enc_key, Vec::new());
+        }
+
+        #[allow(unreachable_patterns)]
+        _ => {}
     }
 
     #[cfg(feature = "aead-cipher-2022")]
diff --git a/crates/shadowsocks/tests/tcp.rs b/crates/shadowsocks/tests/tcp.rs
index 9ea4d3ed..6782723e 100644
--- a/crates/shadowsocks/tests/tcp.rs
+++ b/crates/shadowsocks/tests/tcp.rs
@@ -181,7 +181,7 @@ async fn tcp_tunnel_none() {
 
     let server_addr = "127.0.0.1:33001".parse::<SocketAddr>().unwrap();
     let local_addr = "127.0.0.1:33101".parse::<SocketAddr>().unwrap();
-    tcp_tunnel_example(server_addr, local_addr, "p$p", CipherKind::NONE)
+    tcp_tunnel_example(server_addr, local_addr, "", CipherKind::NONE)
         .await
         .unwrap();
 }
diff --git a/crates/shadowsocks/tests/tcp_tfo.rs b/crates/shadowsocks/tests/tcp_tfo.rs
index 2b287262..3fac4d71 100644
--- a/crates/shadowsocks/tests/tcp_tfo.rs
+++ b/crates/shadowsocks/tests/tcp_tfo.rs
@@ -32,7 +32,7 @@ use tokio::{
 async fn tcp_tunnel_tfo() {
     let _ = env_logger::try_init();
 
-    let svr_cfg = ServerConfig::new(("127.0.0.1", 41000), "?", CipherKind::NONE);
+    let svr_cfg = ServerConfig::new(("127.0.0.1", 41000), "", CipherKind::NONE);
     let svr_cfg_client = svr_cfg.clone();
 
     tokio::spawn(async move {