# What should the character limit(s) for first/last name inputs be? [closed]

We want to create input fields for a user's first and last names. What should the minimum and maximum limits be, if any, and why?

• None. No limits at all, upper or lower. If you set a limit then there will be people who can't add their details correctly. What is your reason for wanting to put limits on there? Worth a read is the classic post falsehoods programmers believe about names – JonW Apr 10 '14 at 12:34
• @JonW - Database data types have limits. Therefore, there has to be a limit. Whether it's VARCHAR(200), VARCHAR(2000), or VARCHAR(MAX), it's still a limit. – Code Maverick Apr 10 '14 at 14:17
• @JonW - Riiiiiiight ... hence why I used VARCHAR. You could also use NVARCHAR to get names with Unicode chars. Point is, you have to have a limit. No limits is an impossibility. – Code Maverick Apr 10 '14 at 14:27
• @JonW None of those falsehoods, while interesting, address length. The reason why you want to put a limit on fields is for security purposes. Say you have code that sanitizes input but an attacker finds a vulnerability in that sanitation that allows them to execute arbitrary code. If your input field doesn't allow them to enter more than 100 chars, then it decreases their options for exploiting the vulnerability. It is entirely reasonable to say that names should have an upper limit in length. If the field is required then obviously the lower limit is at least 1 char. – Charles Wesley Apr 10 '14 at 14:36
• The question here is really what is the shortest length possible while not hindering usability, which is a valid UX question. – Charles Wesley Apr 10 '14 at 14:38

In theory the correct answer is no upper limit for name lengths. Allow the user to enter whatever their name is using whatever characters are available to them so that you will never run into a circumstance where someone is prevented from entering their valid real name.

In practice that is not possible to implement.

There have to be limitations.

These limitations can be subjective, such as what constitutes a "real" name so that you don't end up with names like :

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

To this end Facebook, for example, has a fairly straight forward set of constraints they enforce:

Names can't include:

• Symbols, numbers, unusual capitalization, repeating characters or punctuation
• Characters from multiple languages
• Titles of any kind (ex: professional, religious, etc)
• Words, phrases, or nicknames in place of a middle name
• Offensive or suggestive content of any kind

Length is not explicitly mentioned, however according to this SO post the limit is currently 50 chars.

In Active Directory the Display-Name attribute is limited to 256 characters.

These are just two examples that vary. You could research multiple services to see what their length limits are, but the truth is you need to decide for yourself what is acceptable.

## But why have a limit at all?!?

There is one limitation that is not subjective: security.

Any interface that accepts and internalizes user input absolutely must without question treat input as a threat that must be validated and sanitized. Input should be validated to ensure it is of the correct type, length, format, and range.

Input should be sanitized to prevent little bobby tables from ruining your day. But in the case where a weakness in your sanitation is discovered, the validation step (including checking for length) offers protection by limiting how the attacker can exploit a vulnerability.

There is another objective limitation: storage capacity.

There is nobody in any culture in the entire world that has a name that is legitimately 1,073,741,823 bytes long (the upper bound of a ntext data type in SQL Server). But even that is a limit which is a technical limitation of the data store.

## So what should the limit be?

The problem is that no limit is not an option for several reasons; some arguably subjective while others objective, real, and unavoidable.

But we also don't want to have users be unduly constrained.

A well designed system will ensure that both needs are met without the user ever knowing that there is a limitation in place to begin with. It should be transparently secure and usable.

To that end, I think a reasonable limit should be (arbitrarily) 25% longer than the longest name in your current data set. Given a large enough sample, that should ensure you will be giving your users enough breathing room but not allowing a malicious user to try to exploit your system.

• Sure, however even that is only 107 bytes which would be perfectly acceptable in Active Directory, and would leave 1,073,741,716 unused bytes in an ntext column. – Charles Wesley Apr 10 '14 at 15:21
• @JonW - That's only 107 characters long though, and like I said up top, the longest name recorded by Guinness is 226 characters long, which is well within the limits of string storage in any database. – Code Maverick Apr 10 '14 at 15:22
• It may also be worth considering the UX implications of displaying arbitrary length names. – Dan Bryant Apr 10 '14 at 15:59
• I hate Facebook as an example because they do not allow even common punctuation in names. The dot in my name is a bit unusual but I have friends who are unable to enter their actual name which legitimately contains characters Facebook doesn't like. I hope @NogaNitzan's implementation considers the character set as well as the length. – T.Rob Apr 11 '14 at 13:03

Given the diversity of names, I wouldn't...

1. set a floor or ceiling limit on name length,
2. OR even break the name into two separate fields.

Depending on the country / cultural background of a person, they may have a more Westernized [first-name] [surname] name, but they may not. Why possibly bar users from entering their complete name because of arbitrary limits?

If your reason for splitting the first and last names into separate fields is so you could possibly address a user by their first or last name, I would suggest providing an additional, optional field for the user asking for their nickname or how they would like to be addressed.

• Could you show us all how to not set a floor or ceiling limit on name length? What data type do you use to store an infinite amount of data? – Code Maverick Apr 10 '14 at 14:36
• First-name surname split into 2 different fields is also really annoying even if your name does fit into that paradigm. Most people instintively type their full name (it's an automatic thing almost like a signature), and then have to go back and correct it to split into 2 fields. – Franchesca Apr 10 '14 at 15:12
• If you don't set an upper limit, some smart-alec is going to come along and drop a copy of the King James Bible in the name field. – Mark Apr 11 '14 at 7:13
• @Mark Nice hyperbolic example there. So to ward that off, I should set a maximum 30-character limit? – Hynes Apr 11 '14 at 15:17
• If you want. Personally, I'd set it to something more reasonable, such as 255 characters. – Mark Apr 12 '14 at 10:31

50 characters (of which 15-25, depending on layout, are visible in the form input field) for the family name should be plenty. It's what works well for me, anyway. For consistency, one should assign the same amount for the first name(s).
I decided for the number 50 a decade or so ago because the longest realistic name I could come up with ad hoc was 15 characters, and 3x15 = 45 (3x for being safe), rounded up to 50. I've been using that magic number since then, and so far not had any complaints. Not expecting any, either.

Yes, in an ideal world, there should be no limits, and every limit that you choose is "wrong" the moment you choose it. We, however, live in a real world where storage (and screen space) is finite and where forms need to be laid out in a sensible, meaningful way.
If your parents decided to give you a 350-letter name, the clerk in the register office will tell you that you're out of luck getting a passport with that name as well. No, they're not going to make an extra-large passport just for you.

The longest claimed surname assigned to an alleged person has 35 letters, although the name ("Wolfeschlegelsteinhausenbergerdorff") looks much more like a hoax than a real name. Though it might be a real person who deliberately chose such a name for making himself important, you can never know.
I doubt it, though, since in particular when you look at the well-known meme Wolfeschlegelsteinhausenbergerdorffwelchevoralternwarengewissenshaftschafers [...] which is not a German name but an entire narrative in some kind of pidgin German that roughly translates to something like "... who a long time ago were diligent shepherds whose well-maintained very diligent knitter-free and protecting gear which [another 3 levels of indirections, and more nonsensical blah blah]", it appears as completely made-up bullshit.

It's admittedly a slightly different story for Mr. Preston from Lancashire, who to all appearances is a real person with an insane parent (or two insane parents), but actually not so much different.
Mr. Preston will not be massively impaired (nor will there be a chance of confusing him with someone else) if he can only enter "Jensen Jay Alexander Bikey Carlisle Duff Elliott" for his first name(s). He will likely only want to use "Jensen Jay" or "Jay" anyway, and curse his father every time kids in school make fun of his names.

Even most existing names for locations (which are generally much longer than names given to people) can fit into 50 characters, with the Maori name of a small hill in New Zealand being the exception. Since there's only about 60,000 people speaking that language at all, and most people on the planet probably have never heard of that unimportant hill, that's rather neglegible.
Every other existing location's name on the planet will fit into these constraints at least with its short form (1 place in Wales) or completely (every other known place).

• Multiple positive aspects to this answer, but I decided I couldn't justify up-voting due to choice of language used. – TOOGAM Feb 5 '18 at 0:10

Based on the type of the application you may want to select an upper or lower limit for the names. The upper limit though a tricky approach the lower limit may be 1 char since the person may choose to write an initial instead of the complete name. If your system requires a name then obviously you wouldn't want the user to exit without entering a name at all.

Selection of the upper limit on the chars will also depend on the kind of implementation and the target audience that you expect to host.

If your implementation is of the social networking order you can let the user set an exceptionally long name, well it is social networking so you can't restrict the user from going crazy. However you can guide him/her by restricting to a certain upper limit (else they may want to insert a 1024 chars long post as the name itself). Increasing UX is highly important but then there's always the trade off somewhere so if you remove the concept of the first and last name and provide a single field for name with say 300-350 chars as an upper limit it will be long enough to experiment and yet short enough to keep you site sane.

For a semi/non social networking order where you expect people coming expecting some information and that they may be kind of serious (atleast not in the social networking mood) then they may prefer keeping it simple and realistic when it comes to names. You may choose to set a limit around a safe 100-125 chars for each of the first and second name. It is pretty evident that we cannot judge the kind of names that we may encounter hence will have to be generous in limiting it.

Moreover you may want to restrict the use of special characters in the name (again based on the implementation), although this may not be related to the question that you asked but it was popping up in my head time and again so just shared it.

• None of this really says why you'd set these limits. What does 'short enough to keep your site sane' mean? What are the 'implementation' issues that would necessitate character limits? (and that's more of an implementation issue that you're transferring onto the user rather than dealing with it technically). I also disagree with restricting special characters. Again, why do this? There will be people with á, ' or & in their name. And certainly with brackets (). Also how does having a limit 'guide him/her by restricting to an upper limit' work? What are you guiding? And why? – JonW Apr 10 '14 at 13:10
• Hey JonW, I did not mean to offend you. Okay I'll try addressing to the points one at a time. By short enough I meant that if your site hosts a multitude of users who may be shown together (let say as result to a search) then if we have like really long names (say ranging into 1024 chars) then primarily it may ruin the UI and also the UX associated with it may be hampered. By implementation I meant the nature of the site/ application, which can help the UX designers take a call on the kind of target audience they can expect and kind of interaction from the audience. – roni Apr 10 '14 at 13:20
• About the special characters, if we take the example of a professional website say LinkedIn.com where people interact on a professional basis if we have some users with names like N@th@n or Ron!, it would somehow drive away the seriousness for viewing their profile where as if you have those names in a social networking site then probably it would look cool so that might even work there. Here my perspective was considering the visitors to the site and based on the purpose of the site. – roni Apr 10 '14 at 13:25
• I'm not offended, just wanted to see some reasoning. You make some valid points actually, but they're mostly related to display usernames, not users actual names. – JonW Apr 10 '14 at 13:53
• Oh yes. My perspective was with what and how it is to be displayed. However I do have a doubt, if we give the user the freedom of infinite sized names (for the system) how will the database be designed for those fields since there it will be required to set some limit for the field and if not set then based on the datatype there will be a default limit that the system will set. So how will we handle this ? – roni Apr 11 '14 at 4:59