Take the 2-minute tour ×

I've seen a lot of information on best practices for dealing with lost password on websites, but what about usernames?

Is there a standard way of dealing with this?

My basic idea is to ask for the users email and send the username to that email. I'm wondering if something more secure along the lines of password recovery (hint questions, etc) is in order.

share|improve this question

migrated from stackoverflow.com May 19 '11 at 18:09

This question came from our site for professional and enthusiast programmers.

Password recovery is an anti-practice. Password reset is the best practice there. –  Rein Henrichs May 19 '11 at 18:26
If I had a site I designed myself this is what I would require to be told what my username was. DOB, email, and the answer to one of the random security question connected to the account. In order to reset the password you would have to provide the DOB, username, and email address AND verify you actually want to reset the password. Once you start to reset the password I would ask 2 of the random security questions and of course not allow the current password. –  Ramhound May 19 '11 at 18:49
add comment

4 Answers

Not a direct answer, but why use a username at all for login? It seems that the world is trending toward using e-mail as login, and I really love this approach. You have built-in uniqueness (assuming no one spoofed your e-mail), and you aren't going to forget your e-mail address.

share|improve this answer
I would have to agree with the statement, what good is a username, if its connected to an email account. The only time I would not agree is if there is a "Display Name" and a "Username" Sony actually does this for their Station accounts. –  Ramhound May 19 '11 at 18:46
Agreed - no problem with a "display name", as it's not used for logging in. :) –  sarumont May 20 '11 at 17:33
Only slight downer is if you ever want to change your e-mail address (as I recently did) - you then have to go round every damn site changing it :-( –  HappyCat May 23 '11 at 13:05
add comment

this seems to be what most of the websites that offer username security do. I don't personally think that more security is needed then asking for their email and then emailing it to them if its correct. By nature usernames are a lot less secure then passwords, so adding an extra layer of security is not needed.

share|improve this answer
add comment

No security is really necessary on usernames. After all, they are usually displayed publicly anyway.

share|improve this answer
add comment

Best practices do not have to cover the scenario of username recovery, since if a website follows the best practices, the users can log on using either their username or their mail address. If they forgot both, it's probably impossible to help them, unless through the website interface.

If the user log on using her mail address, she has in all cases the access to her username on "My profile" page. It means that even if the user forgets the username but want to use it later rather than typing her very-long-mail-address every time, it is easy to access it without any special procedure.

share|improve this answer
I've had problems in the past remembering which email address I'd used. Lots of people have several. –  David Thornley May 19 '11 at 19:51
@David Thornley: I use several too. If I forget which one I used, I just have to try all of them. There is no magical way to get it for me (except connecting my brain to the Matrix and hacking into my memory). –  MainMa May 20 '11 at 22:15
add comment

Your Answer


