3d ago

What is the maximum username length for a Lemmy account?

Solution

The Lemmy server appears to have a database limit of 255 characters ^[2]; however, individual instances appear to put their own limits on username length ^{[3][4.1][4.2]}.

Original Post

If you know, please also provide relevant documentation.

UPDATE (2025-02-02T06:06Z): I did some brute-force testing, and, at least for sh.itjust.works, it seems that the maximum username length is 50, and the maximum password length is 60 ^[1].

You're viewing a single thread.

12 comments

A password max length shouldn't be needed if they store a hash of it in the db.
- It's possible that Lemmy uses fixed-size buffers for the username and unhashed password. It would be pretty bad to give an unauthenticated user the power to allocate hundreds of megabytes in a shared process.
  Not that I read the source code to know for sure, but it's common practice to reduce the opportunity for denial of service attacks by limiting user input size.
- It's up to the UI as to how much data to accept AFAIK. The lemmy-ui will truncate passwords beyond 60. So even if you have a 64 char password it will drop the last 4 and do the hashing on that.
  
  […] The lemmy-ui will truncate passwords beyond 60. So even if you have a 64 char password it will drop the last 4 and do the hashing on that.
  At least on sh.itjust.works, it doesn't just silently truncate the password; it throws an error ^[1]:
  
  Oh, that's good. My experience is from when joining .world during the API exodus.

12 comments