Tell me more ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.
up vote 3 down vote favorite

I am wondering because I am trying to make sure that person have right amount of spaces for their user name.

User Name and Password are security measures and should not be easy to guess. I have fixed amount of characters to Passwords no shorter than 6 characters because most sites use 6-8 characters when create an account. Because of limitation of my progams database file I cannot have passwords longer than 20 characters. What about User Name field? Too short User Name would be too easy to guess, too long, might cause program errors (since maximum length of single line TextBox in .Net/C# is about 32767 characters).

What should be the maximum and minimum length of User Name and Password fields?

share|improve this question
3  
You probably should be storing a password hash. That hash can be precisely 20 characters regardless of the length of the actual password. – MSalters Dec 5 '11 at 10:52
user name is not a security measure, and this site is not the right place to ask about passwords imho, try security.stackexchange.com – jk. Dec 5 '11 at 11:31
Please allow 3 characters usernames, my username is usually M28, but sometimes some forms don't allow it :( – user3416 Dec 5 '11 at 15:12
IMHO security can have strong impact in design. As ux designers we should gather security requiriments that could impact design. What do you think? – jrosell Dec 5 '11 at 18:57
kalzumeus.com/2010/06/17/… suggests that you are wrong if you assume that all users have names :P – MikeNereson Dec 5 '11 at 19:19

3 Answers

up vote 6 down vote accepted

Between 6 and 20 characters for a password is acceptable, although I would normally not have restricted the password length quite so tightly at the max end (see my final comment in bold, below).

A username however should be able to be short. If your application requires the username to be unguessable, then you might as well ask for two passwords rather than one.

If I'm an early adopter of a product/website/startup I like to be able to choose a short username - perhaps my first name, after all it's usually a name by which I refer to myself in the context of your application, and an id by which the application will refer to me.

Therefore I would think twice before restricting the minimum length of a username at all - other than non-blank of course. In any case you need to validate a username against those that exist already (I suggest in-line validation here).

With respect to the maximum length, anyone who enters a really long username is digging a hole for themselves anyway as they may well end up having to type that username frequently in the future.

You should also think beyond the textbox max-length restriction as to where and how that username mught be stored, displayed and used in the future. Could it ever form part of an email address, a filename, a sub-level domain prefix, etc, etc. (I'm sure you'll have more pertinent questions for your own application context).

I'm torn between the 'why restrict it at all' option and the 'keep it short enough never to be a problem'. I believe 32767 would be a mistake that could come back to bite you at some future point and I would advise an option where you can understand and deal with a known quantity in the future with the minimum of fuss.

For this reason, while taking the above consideration about future uses into account I would make the username length as long as possible, but no shorter then necessary.

share|improve this answer
2  
For systems with a 'non displayed' username I often use my email address (so its consistent with systems which DO use my email address as the username). So you want a username length which will handle a corporate email length - and some of these can be pretty long. – PhillipW Dec 5 '11 at 10:30
@PhillipW - a great example for keeping such restrictions as long as possible but no shorter than necessary - it is not for the application to second guess how users will choose their username! – Roger Attrill Dec 5 '11 at 10:35
up vote 2 down vote

The RFC standard is usually around 254 characters (e.g. for Emails), so I would stick to that one...

share|improve this answer
That answers half the question, fine. The minimum length is of much greater concern, though. (I have not checked out the link above, yet.) – Kris Dec 5 '11 at 10:03
3  
I guess the min length for a username should be at least 2 characters (thinking of Asian names here), unless it's an email (in that case min email length is 5 chars). Regarding passwords, there are tons of different opinions - like the length is not all but also what's included like special chars and numbers - that is purely your own requirement and decision... Hope this helps – Leon Dec 5 '11 at 10:48
What about Koreans? World's Shortest and Longest Names Found. :) – HelpNeeder Dec 5 '11 at 12:17
yes well Korea is in Asia, at least in my world map ;-) and as you also have shown, 2 characters is the "shortest" name... If this answers your question, please mark as Answer for the other members... Thanks – Leon Dec 5 '11 at 12:33
Geography was never my favorite subject. I will give this thread a little more time before I will consider accepting. Although, person did pointed out few things worth considering, I like to leave my questions open for a day or two. – HelpNeeder Dec 5 '11 at 12:43
up vote 0 down vote

The minimum password length for systems that deal with credit card numbers should be 7 alpha-numeric characters according to PCI Security Standards.

share|improve this answer
2  
Which is a load of nonsense because the number of characters is only a small part of entropy. A better password contains an unpredictable combination of characters. Moreover, Section 8 of the document (the origin of your claim) pertains passwords for people who have physical access to the PCI-compliant system. – dnbrv Jul 9 '12 at 19:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.