What should the character limit(s) for first/last name inputs be? [closed]

Question

We want to create input fields for a user's first and last names. What should the minimum and maximum limits be, if any, and why?

Answer 1

In theory the correct answer is no upper limit for name lengths. Allow the user to enter whatever their name is using whatever characters are available to them so that you will never run into a circumstance where someone is prevented from entering their valid real name.

In practice that is not possible to implement.

There have to be limitations.

These limitations can be subjective, such as what constitutes a "real" name so that you don't end up with names like :

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

To this end Facebook, for example, has a fairly straight forward set of constraints they enforce:

Names can't include:

• Symbols, numbers, unusual capitalization, repeating characters or punctuation
• Characters from multiple languages
• Titles of any kind (ex: professional, religious, etc)
• Words, phrases, or nicknames in place of a middle name
• Offensive or suggestive content of any kind

Length is not explicitly mentioned, however according to this SO post the limit is currently 50 chars.

In Active Directory the Display-Name attribute is limited to 256 characters.

These are just two examples that vary. You could research multiple services to see what their length limits are, but the truth is you need to decide for yourself what is acceptable.

But why have a limit at all?!?

There is one limitation that is not subjective: security.

Any interface that accepts and internalizes user input absolutely must without question treat input as a threat that must be validated and sanitized. Input should be validated to ensure it is of the correct type, length, format, and range.

Input should be sanitized to prevent little bobby tables from ruining your day. But in the case where a weakness in your sanitation is discovered, the validation step (including checking for length) offers protection by limiting how the attacker can exploit a vulnerability.

There is another objective limitation: storage capacity.

There is nobody in any culture in the entire world that has a name that is legitimately 1,073,741,823 bytes long (the upper bound of a ntext data type in SQL Server). But even that is a limit which is a technical limitation of the data store.

So what should the limit be?

The problem is that no limit is not an option for several reasons; some arguably subjective while others objective, real, and unavoidable.

But we also don't want to have users be unduly constrained.

A well designed system will ensure that both needs are met without the user ever knowing that there is a limitation in place to begin with. It should be transparently secure and usable.

To that end, I think a reasonable limit should be (arbitrarily) 25% longer than the longest name in your current data set. Given a large enough sample, that should ensure you will be giving your users enough breathing room but not allowing a malicious user to try to exploit your system.

Answer 2

Given the diversity of names, I wouldn't...

1. set a floor or ceiling limit on name length,
2. OR even break the name into two separate fields.

Depending on the country / cultural background of a person, they may have a more Westernized [first-name] [surname] name, but they may not. Why possibly bar users from entering their complete name because of arbitrary limits?

If your reason for splitting the first and last names into separate fields is so you could possibly address a user by their first or last name, I would suggest providing an additional, optional field for the user asking for their nickname or how they would like to be addressed.

Answer 3

Based on the type of the application you may want to select an upper or lower limit for the names. The upper limit though a tricky approach the lower limit may be 1 char since the person may choose to write an initial instead of the complete name. If your system requires a name then obviously you wouldn't want the user to exit without entering a name at all.

Selection of the upper limit on the chars will also depend on the kind of implementation and the target audience that you expect to host.

If your implementation is of the social networking order you can let the user set an exceptionally long name, well it is social networking so you can't restrict the user from going crazy. However you can guide him/her by restricting to a certain upper limit (else they may want to insert a 1024 chars long post as the name itself). Increasing UX is highly important but then there's always the trade off somewhere so if you remove the concept of the first and last name and provide a single field for name with say 300-350 chars as an upper limit it will be long enough to experiment and yet short enough to keep you site sane.

For a semi/non social networking order where you expect people coming expecting some information and that they may be kind of serious (atleast not in the social networking mood) then they may prefer keeping it simple and realistic when it comes to names. You may choose to set a limit around a safe 100-125 chars for each of the first and second name. It is pretty evident that we cannot judge the kind of names that we may encounter hence will have to be generous in limiting it.

Moreover you may want to restrict the use of special characters in the name (again based on the implementation), although this may not be related to the question that you asked but it was popping up in my head time and again so just shared it.

Answer 4

50 characters (of which 15-25, depending on layout, are visible in the form input field) for the family name should be plenty. It's what works well for me, anyway. For consistency, one should assign the same amount for the first name(s).
I decided for the number 50 a decade or so ago because the longest realistic name I could come up with ad hoc was 15 characters, and 3x15 = 45 (3x for being safe), rounded up to 50. I've been using that magic number since then, and so far not had any complaints. Not expecting any, either.

Yes, in an ideal world, there should be no limits, and every limit that you choose is "wrong" the moment you choose it. We, however, live in a real world where storage (and screen space) is finite and where forms need to be laid out in a sensible, meaningful way.
If your parents decided to give you a 350-letter name, the clerk in the register office will tell you that you're out of luck getting a passport with that name as well. No, they're not going to make an extra-large passport just for you.

The longest claimed surname assigned to an alleged person has 35 letters, although the name ("Wolfeschlegelsteinhausenbergerdorff") looks much more like a hoax than a real name. Though it might be a real person who deliberately chose such a name for making himself important, you can never know.
I doubt it, though, since in particular when you look at the well-known meme Wolfeschlegelsteinhausenbergerdorffwelchevoralternwarengewissenshaftschafers [...] which is not a German name but an entire narrative in some kind of pidgin German that roughly translates to something like "... who a long time ago were diligent shepherds whose well-maintained very diligent knitter-free and protecting gear which [another 3 levels of indirections, and more nonsensical blah blah]", it appears as completely made-up bullshit.

It's admittedly a slightly different story for Mr. Preston from Lancashire, who to all appearances is a real person with an insane parent (or two insane parents), but actually not so much different.
Mr. Preston will not be massively impaired (nor will there be a chance of confusing him with someone else) if he can only enter "Jensen Jay Alexander Bikey Carlisle Duff Elliott" for his first name(s). He will likely only want to use "Jensen Jay" or "Jay" anyway, and curse his father every time kids in school make fun of his names.

Even most existing names for locations (which are generally much longer than names given to people) can fit into 50 characters, with the Maori name of a small hill in New Zealand being the exception. Since there's only about 60,000 people speaking that language at all, and most people on the planet probably have never heard of that unimportant hill, that's rather neglegible.
Every other existing location's name on the planet will fit into these constraints at least with its short form (1 place in Wales) or completely (every other known place).