3d ago

What is the maximum username length for a Lemmy account?

Solution

The Lemmy server appears to have a database limit of 255 characters ^[2]; however, individual instances appear to put their own limits on username length ^{[3][4.1][4.2]}.

Original Post

If you know, please also provide relevant documentation.

UPDATE (2025-02-02T06:06Z): I did some brute-force testing, and, at least for sh.itjust.works, it seems that the maximum username length is 50, and the maximum password length is 60 ^[1].

12 comments

It seems to be set per-instance - you can find out through their APIs:
curl -L http://lemmy.world/api/v3/site | jq -r .site_view.local_site.actor_name_max_length (26)
curl -L http://sh.itjust.works/api/v3/site | jq -r .site_view.local_site.actor_name_max_length (50)
- Is there any official documentation for that? Lemmy's API docs ^[1] seem rather sparse on the subject.
  UPDATE (2025-02-02T23:23Z): I found this ^[2] and this ^[3], but unfortunately it doesn't contain much information.
  
  Not much. I think Lemmy's current API docs are generated from the JS client. So I guess there's
  https://join-lemmy.org/lemmy-js-client-docs/v0.19/interfaces/LocalSite.html#actor_name_max_length
  This refers to the wrong line number though, it's actually at:
  https://github.com/LemmyNet/lemmy-js-client/blob/ad9f402e06292899a35927c46fe48b22c6f5eb27/src/types/LocalSite.ts#L59

It might be 255 characters?
Assuming that's the field applicable to this question, there isn't some other limit somewhere other than the database and that I didn't miss another later migration that changes the field length etc. I haven't looked terribly thoroughly, though.
- Can’t wait for the 255 username posting to 255 community @ 255 (253?) instance

A password max length shouldn't be needed if they store a hash of it in the db.
- It's possible that Lemmy uses fixed-size buffers for the username and unhashed password. It would be pretty bad to give an unauthenticated user the power to allocate hundreds of megabytes in a shared process.
  Not that I read the source code to know for sure, but it's common practice to reduce the opportunity for denial of service attacks by limiting user input size.
- It's up to the UI as to how much data to accept AFAIK. The lemmy-ui will truncate passwords beyond 60. So even if you have a 64 char password it will drop the last 4 and do the hashing on that.
  
  […] The lemmy-ui will truncate passwords beyond 60. So even if you have a 64 char password it will drop the last 4 and do the hashing on that.
  At least on sh.itjust.works, it doesn't just silently truncate the password; it throws an error ^[1]:

12 comments