# Username or handle

**Test family:** `USR`

Treat a username as an identity field, not generic text. Determine the product’s rules for accepted characters, length, case, normalization, email/phone aliases, rename, reuse, and privacy before declaring convention-dependent cases pass or fail.

## Semantics and accepted values

- **USR-001** Submit an empty username; enforce the required/optional policy clearly and server-side.
- **USR-002** Submit a one-character username; accept or reject it according to an explicit minimum rather than an accidental parser rule.
- **USR-003** Submit all-numeric usernames such as `7` and `12345`; follow the documented identity policy consistently.
- **USR-004** Try letters, digits, and every advertised separator; accept characters consistently across every identity flow.
- **USR-005** Put separators at the beginning and end; reject invalid placement without silent, identity-changing normalization.
- **USR-006** Repeat separators, as in `jason__arbon`; apply one explicit rule.
- **USR-007** Compare `Jason`, `jason`, and `JASON`; registration, login, lookup, display, and recovery must use coherent case semantics.
- **USR-008** Add leading and trailing whitespace; trim, preserve, or reject it deliberately and consistently.
- **USR-009** Try reserved and route-like names such as `admin`, `support`, `root`, `system`, `api`, `login`, and `me`; prevent impersonation and routing conflicts.
- **USR-010** Enter email- and phone-shaped values; accept them only when “username” explicitly includes those identities.

## Length and transport boundaries

- **USR-011** Test minimum−1, minimum, and minimum+1 characters; enforce the real minimum in UI and server paths.
- **USR-012** Test maximum−1, maximum, and maximum+1 characters; never truncate or clip silently.
- **USR-013** When limits are unknown, probe relevant `7/8/9`, `15/16/17`, `31/32/33`, `63/64/65`, and larger powers-of-two boundaries safely.
- **USR-014** Compare character, code-point, grapheme, UTF-8 byte, and encoded-byte length where layers count differently.
- **USR-015** Bypass client length/character constraints through the request or API; require the same server contract.
- **USR-016** Reload, search, mention, notify, audit, and export a boundary-length username; preserve the same intended identity through every layer.

## Unicode and normalization

- **USR-017** Use accented and non-Latin usernames; retain every supported writing system faithfully.
- **USR-018** Compare composed and decomposed equivalents such as `é` versus `e` plus a combining mark; prevent unintended duplicate identities.
- **USR-019** Try Unicode confusables such as Latin `a` versus Cyrillic `а`; detect, warn about, or deliberately permit spoofable identities.
- **USR-020** Insert zero-width and other invisible characters; prevent misleading duplicates and invisible display differences.
- **USR-021** Use right-to-left and mixed-direction text; keep display, cursor movement, search, and surrounding labels understandable.
- **USR-022** Use emoji and multi-code-point graphemes; apply an explicit acceptance and length-counting policy.

## Control behavior and accessibility

- **USR-023** Provide a persistent visible label and accessible name that identify the value as Username; do not rely on placeholder text.
- **USR-024** Type, paste, autofill, undo, redo, select-all, and replace; preserve the intended username through every supported entry method.
- **USR-025** Use IME composition and rapid typing; do not validate or corrupt partially composed text.
- **USR-026** Trigger validation on edit, blur, and submit; show errors at a useful time and associate them with the field.
- **USR-027** Correct an invalid username after completing adjacent fields; retain unrelated valid work.
- **USR-028** Operate by keyboard and screen reader; expose focus, label, required state, error, and suggestions.
- **USR-029** Test narrow screens, 200% text, 400% reflow, and translated labels; keep the label, value, errors, and actions usable.
- **USR-030** Configure autocomplete, autocorrect, autocapitalize, spellcheck, and input mode for username semantics without altering identity.

## Uniqueness and lifecycle

- **USR-031** Register an exact duplicate username; reject the duplicate atomically.
- **USR-032** Register a normalization-equivalent duplicate; prevent normalization from bypassing uniqueness.
- **USR-033** Race two registrations or renames to the same username; allow exactly one committed identity.
- **USR-034** Rename a username; keep login, profile URL, mentions, ownership, audit, search, and notifications coherent.
- **USR-035** Visit an old profile URL after rename; apply an explicit redirect, tombstone, reservation, or reuse policy that prevents impersonation.
- **USR-036** Create or change usernames through signup, admin, import, API, SSO, and migration; enforce the same contract everywhere.

## Login, recovery, privacy, and resilience

- **USR-037** Compare unknown username, wrong password, disabled user, locked user, and unverified user responses; do not reveal account existence beyond policy through copy, status, timing, or recovery.
- **USR-038** Use case and normalization variants during login and recovery; match the registration identity rules.
- **USR-039** Search for another tenant’s or private username; prevent leakage through suggestions, results, counts, timing, caches, and errors.
- **USR-040** Inspect URLs, logs, analytics, errors, audit, notifications, browser storage, and screenshots; expose the username only according to its privacy classification and never carry adjacent secrets.
- **USR-041** Use inert quote/markup/path/template probes such as `CARBON'\"&<>`; keep them harmless in validation, display, logs, notifications, and exports.
- **USR-042** Retry after timeout or repeated submission; create no duplicate account, rename, audit event, or misleading success state.

## Product decisions to resolve

Do not invent these oracles:

- accepted character classes and separators;
- minimum and maximum length, including the counting unit;
- case sensitivity and normalization;
- whether email or phone can act as the username;
- reserved-name policy;
- rename, old-link, and name-reuse policy;
- account-enumeration and username-privacy policy.

## Comprehensive per-item coverage

- **USR-043** Enter ordinary lowercase, uppercase, mixed-case, numeric, and alphanumeric values; apply the documented character policy consistently.
- **USR-044** Enter ASCII emoticons such as `:)`, `:-)`, `;)`, `:D`, `:(`, and `<3`; accept or reject each deliberately without corruption, partial stripping, or a server error.
- **USR-045** Enter kaomoji and symbol-heavy emoticons such as `¯\_(ツ)_/¯`, `(╯°□°)╯︵ ┻━┻`, and `ಠ_ಠ`; preserve or reject the whole value predictably.
- **USR-046** Enter a single emoji, repeated emoji, skin-tone modifier, variation selector, keycap, flag, and ZWJ family/profession sequence; count and validate complete grapheme clusters.
- **USR-047** Mix letters, digits, punctuation, emoticons, and emoji in one value; never normalize it into a different accepted identity or meaning.
- **USR-048** Try ASCII control characters, tab, newline, carriage return, null, non-breaking space, word joiner, and zero-width characters through UI and direct requests.
- **USR-049** Try Latin accents, decomposed accents, CJK, Arabic, Hebrew, Devanagari, and mixed-script text; preserve supported scripts and explain unsupported ones.
- **USR-050** Try left-to-right, right-to-left, and bidi-override/isolate characters; keep value, cursor, error, surrounding label, logs, and exports unambiguous.
- **USR-051** Compare visually confusable values using Latin, Cyrillic, Greek, digits, homoglyph punctuation, and normalization equivalents; prevent unintended duplicates or spoofing.
- **USR-052** Exercise exact lower and upper boundaries using ASCII, two-byte characters, four-byte emoji, and multi-code-point graphemes; enforce the declared counting unit everywhere.
- **USR-053** Send the same value through form encoding, JSON, multipart, URL query/path, API, import, and mobile/native clients where applicable; decode exactly once.
- **USR-054** Use inert SQL, markup, script, template, command, path, CSV-formula, and log-forging canaries; keep them data in validation, storage, display, notifications, analytics, and export.
- **USR-055** Type slowly and rapidly, paste plain/rich text, drag text, use autofill, dictate, compose with an IME, undo/redo, and replace a selection; converge on the same value.
- **USR-056** Bypass `maxlength`, `pattern`, `required`, input type, disabled, and client validation; require the authoritative server contract and a useful error.
- **USR-057** Save, reload, navigate back/forward, reopen, search, sort, mention, notify, audit, sync, import, and export the value; preserve intended content and policy.
- **USR-058** Edit the same value concurrently from two sessions and retry after timeout; detect conflicts and avoid duplicate side effects or silent overwrites.
- **USR-059** Exercise offline, validation timeout, save failure, partial response, reconnect, and session expiry; retain recoverable input and never claim false success.
- **USR-060** Verify label, instructions, required state, error, suggestions, character count, focus, and current value with keyboard, switch, voice, and screen-reader use.
- **USR-061** Test narrow viewport, zoom/reflow, large fonts, high contrast, reduced motion, translated copy, locale-specific input, and mobile keyboards without hiding or altering the value.
- **USR-062** Measure validation and save behavior near maximum size and during rapid input; avoid UI freezes, request storms, timing leaks, and unbounded downstream work.
- **USR-063** Inspect DOM, URL, clipboard, browser storage, telemetry, logs, traces, crash reports, notifications, and screenshots; expose the value only according to its data classification.
- **USR-064** Delete, clear, reset, cancel, and restore the value; distinguish intentional removal from lost input and honor retention, audit, and recovery policy.

[Back to Input controls index](../../controls-input.md)
