15

I am wondering because I am trying to make sure that person have right amount of spaces for their user name.

User Name and Password are security measures and should not be easy to guess. I have fixed amount of characters to Passwords no shorter than 6 characters because most sites use 6-8 characters when create an account. Because of limitation of my progams database file I cannot have passwords longer than 20 characters. What about User Name field? Too short User Name would be too easy to guess, too long, might cause program errors (since maximum length of single line TextBox in .Net/C# is about 32767 characters).

What should be the maximum and minimum length of User Name and Password fields?

6
  • 4
    You probably should be storing a password hash. That hash can be precisely 20 characters regardless of the length of the actual password.
    – MSalters
    Dec 5, 2011 at 10:52
  • 3
    user name is not a security measure, and this site is not the right place to ask about passwords imho, try security.stackexchange.com
    – jk.
    Dec 5, 2011 at 11:31
  • 1
    Please allow 3 characters usernames, my username is usually M28, but sometimes some forms don't allow it :(
    – user3416
    Dec 5, 2011 at 15:12
  • 1
    kalzumeus.com/2010/06/17/… suggests that you are wrong if you assume that all users have names :P Dec 5, 2011 at 19:19
  • 1
    Having come across this page while searching for best practices on user name lengths, here's a specific discussion on the Information Security Stack Exchange site on why you would want a fixed, minimum length for user names: security.stackexchange.com/questions/46875/… Nov 8, 2018 at 0:10

3 Answers 3

19

Between 6 and 20 characters for a password is acceptable, although I would normally not restrict the password length quite so tightly at the max end (see my final comment in bold, below).

A username however should be able to be short. If your application requires the username to be unguessable, then you might as well ask for two passwords rather than one.

If I'm an early adopter of a product/website/startup I like to be able to choose a short username - perhaps my first name, after all it's usually a name by which I refer to myself in the context of your application, and an id by which the application will refer to me.

Therefore I would think twice before restricting the minimum length of a username at all - other than non-blank of course. In any case you need to validate a username against those that exist already (I suggest in-line validation here).

With respect to the maximum length, anyone who enters a really long username is digging a hole for themselves anyway as they may well end up having to type that username frequently in the future.

You should also think beyond the textbox max-length restriction as to where and how that username mught be stored, displayed and used in the future. Could it ever form part of an email address, a filename, a sub-level domain prefix, etc, etc. (I'm sure you'll have more pertinent questions for your own application context).

I'm torn between the 'why restrict it at all' option and the 'keep it short enough never to be a problem'. I believe 32767 would be a mistake that could come back to bite you at some future point and I would advise an option where you can understand and deal with a known quantity in the future with the minimum of fuss.

For this reason, while taking the above consideration about future uses into account I would make the username length as long as possible, but no shorter than necessary.

2
  • 2
    For systems with a 'non displayed' username I often use my email address (so its consistent with systems which DO use my email address as the username). So you want a username length which will handle a corporate email length - and some of these can be pretty long.
    – PhillipW
    Dec 5, 2011 at 10:30
  • @PhillipW - a great example for keeping such restrictions as long as possible but no shorter than necessary - it is not for the application to second guess how users will choose their username! Dec 5, 2011 at 10:35
6

The RFC standard is usually around 254 characters (e.g. for Emails), so I would stick to that one...

5
  • That answers half the question, fine. The minimum length is of much greater concern, though. (I have not checked out the link above, yet.)
    – Kris
    Dec 5, 2011 at 10:03
  • 3
    I guess the min length for a username should be at least 2 characters (thinking of Asian names here), unless it's an email (in that case min email length is 5 chars). Regarding passwords, there are tons of different opinions - like the length is not all but also what's included like special chars and numbers - that is purely your own requirement and decision... Hope this helps
    – Leon
    Dec 5, 2011 at 10:48
  • What about Koreans? World's Shortest and Longest Names Found. :)
    – HelpNeeder
    Dec 5, 2011 at 12:17
  • yes well Korea is in Asia, at least in my world map ;-) and as you also have shown, 2 characters is the "shortest" name... If this answers your question, please mark as Answer for the other members... Thanks
    – Leon
    Dec 5, 2011 at 12:33
  • Geography was never my favorite subject. I will give this thread a little more time before I will consider accepting. Although, person did pointed out few things worth considering, I like to leave my questions open for a day or two.
    – HelpNeeder
    Dec 5, 2011 at 12:43
3

The minimum password length for systems that deal with credit card numbers should be 7 alpha-numeric characters according to PCI Security Standards.

1
  • 3
    Which is a load of nonsense because the number of characters is only a small part of entropy. A better password contains an unpredictable combination of characters. Moreover, Section 8 of the document (the origin of your claim) pertains passwords for people who have physical access to the PCI-compliant system.
    – dnbrv
    Jul 9, 2012 at 19:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.