diff --git a/dlls/kernelbase/path.c b/dlls/kernelbase/path.c
index ad823cae547..fbb4c5152a9 100644
--- a/dlls/kernelbase/path.c
+++ b/dlls/kernelbase/path.c
@@ -4334,6 +4334,8 @@ HRESULT WINAPI UrlGetPartW(const WCHAR *url, WCHAR *out, DWORD *out_len, DWORD p
         break;
 
     case URL_PART_PASSWORD:
+        if (!pl.password)
+            return E_INVALIDARG;
         if (!pl.password_len)
         {
             *out = '\0';
diff --git a/dlls/shlwapi/tests/url.c b/dlls/shlwapi/tests/url.c
index 5d982467cea..54342d1e5c2 100644
--- a/dlls/shlwapi/tests/url.c
+++ b/dlls/shlwapi/tests/url.c
@@ -622,24 +622,24 @@ static void test_UrlGetPart(void)
         {"http://foo:bar@localhost:21/internal.php?query=x&return=y", URL_PART_QUERY, URL_PARTFLAG_KEEPSCHEME, S_OK, "query=x&return=y"},
 
         {"http://localhost/", URL_PART_USERNAME, 0, E_INVALIDARG},
-        {"http://localhost/", URL_PART_PASSWORD, 0, E_INVALIDARG, .todo_hr = TRUE},
+        {"http://localhost/", URL_PART_PASSWORD, 0, E_INVALIDARG},
         {"http://localhost/", URL_PART_HOSTNAME, 0, S_OK, "localhost"},
         {"http://localhost/", URL_PART_PORT, 0, E_INVALIDARG, .todo_hr = TRUE},
         {"http://localhost/", URL_PART_QUERY, 0, S_FALSE, ""},
 
         {"http://localhost:port/", URL_PART_USERNAME, 0, E_INVALIDARG},
-        {"http://localhost:port/", URL_PART_PASSWORD, 0, E_INVALIDARG, .todo_hr = TRUE},
+        {"http://localhost:port/", URL_PART_PASSWORD, 0, E_INVALIDARG},
         {"http://localhost:port/", URL_PART_HOSTNAME, 0, S_OK, "localhost"},
         {"http://localhost:port/", URL_PART_PORT, 0, S_OK, "port"},
         {"http://:", URL_PART_HOSTNAME, 0, S_FALSE, ""},
         {"http://:", URL_PART_PORT, 0, S_FALSE, ""},
 
         {"http://user@localhost", URL_PART_USERNAME, 0, S_OK, "user"},
-        {"http://user@localhost", URL_PART_PASSWORD, 0, E_INVALIDARG, .todo_hr = TRUE},
+        {"http://user@localhost", URL_PART_PASSWORD, 0, E_INVALIDARG},
         {"http://user@localhost", URL_PART_HOSTNAME, 0, S_OK, "localhost"},
         {"http://user@localhost", URL_PART_PORT, 0, E_INVALIDARG, .todo_hr = TRUE},
         {"http://@", URL_PART_USERNAME, 0, S_FALSE, ""},
-        {"http://@", URL_PART_PASSWORD, 0, E_INVALIDARG, .todo_hr = TRUE},
+        {"http://@", URL_PART_PASSWORD, 0, E_INVALIDARG},
         {"http://@", URL_PART_HOSTNAME, 0, S_FALSE, ""},
 
         {"http://user:pass@localhost", URL_PART_USERNAME, 0, S_OK, "user"},