I've seen a lot of information on best practices for dealing with lost password on websites, but what about usernames?

Is there a standard way of dealing with this?

My basic idea is to ask for the users email and send the username to that email. I'm wondering if something more secure along the lines of password recovery (hint questions, etc) is in order.

  • 7
    Password recovery is an anti-practice. Password reset is the best practice there. – Rein Henrichs May 19 '11 at 18:26
  • 1
    If I had a site I designed myself this is what I would require to be told what my username was. DOB, email, and the answer to one of the random security question connected to the account. In order to reset the password you would have to provide the DOB, username, and email address AND verify you actually want to reset the password. Once you start to reset the password I would ask 2 of the random security questions and of course not allow the current password. – Ramhound May 19 '11 at 18:49

Not a direct answer, but why use a username at all for login? It seems that the world is trending toward using e-mail as login, and I really love this approach. You have built-in uniqueness (assuming no one spoofed your e-mail), and you aren't going to forget your e-mail address.

  • I would have to agree with the statement, what good is a username, if its connected to an email account. The only time I would not agree is if there is a "Display Name" and a "Username" Sony actually does this for their Station accounts. – Ramhound May 19 '11 at 18:46
  • Agreed - no problem with a "display name", as it's not used for logging in. :) – sarumont May 20 '11 at 17:33
  • Only slight downer is if you ever want to change your e-mail address (as I recently did) - you then have to go round every damn site changing it :-( – HappyCat May 23 '11 at 13:05

this seems to be what most of the websites that offer username security do. I don't personally think that more security is needed then asking for their email and then emailing it to them if its correct. By nature usernames are a lot less secure then passwords, so adding an extra layer of security is not needed.


No security is really necessary on usernames. After all, they are usually displayed publicly anyway.


Best practices do not have to cover the scenario of username recovery, since if a website follows the best practices, the users can log on using either their username or their mail address. If they forgot both, it's probably impossible to help them, unless through the website interface.

If the user log on using her mail address, she has in all cases the access to her username on "My profile" page. It means that even if the user forgets the username but want to use it later rather than typing her very-long-mail-address every time, it is easy to access it without any special procedure.

  • I've had problems in the past remembering which email address I'd used. Lots of people have several. – David Thornley May 19 '11 at 19:51
  • @David Thornley: I use several too. If I forget which one I used, I just have to try all of them. There is no magical way to get it for me (except connecting my brain to the Matrix and hacking into my memory). – Arseni Mourzenko May 20 '11 at 22:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.