DEV Community

[Comment from a deleted post]
Collapse
 
_garybell profile image
Gary Bell

Please don't limit characters on the password field. That encourages weak security practices on behalf of the users. Aside from the fact that anything entered into a password field should (read must) be hashed before it's checked against anything, there's much better ways of managing user input than restricting field lengths.

Restricting the size of the username field to prevent anyone dropping a table called user would limit the size of the usernames to be under 21 characters. That's an easy way of annoying users who will have to pick usernames like uZ76jhsyuv just to use a service when all memorable usernames are taken. Also, if people are expected to use their email address as their username, limiting the length of that is seriously detrimental for people. I could just squeeze my shortest email address into that character space.