diff --git a/customize.dist/login.js b/customize.dist/login.js
index efce968ca..15707ca94 100644
--- a/customize.dist/login.js
+++ b/customize.dist/login.js
@@ -99,7 +99,6 @@ define([
         opt.channelHex = parsed.channel;
         opt.keys = parsed.keys;
         opt.edPublic = blockInfo.edPublic;
-        opt.User_name = blockInfo.User_name;
         return opt;
     };
 
diff --git a/lib/storage/block.js b/lib/storage/block.js
index fb82f0e41..9f02fc02b 100644
--- a/lib/storage/block.js
+++ b/lib/storage/block.js
@@ -116,6 +116,8 @@ Block.check = function (Env, publicKey, _cb) { // 'check' because 'exists' impli
     Fs.access(path, Fs.constants.F_OK, cb);
 };
 
+Block.MAX_SIZE = 256; // XXX confirm that this is sufficient, prevent user inputs that would result in larger blocks
+
 Block.write = function (Env, publicKey, buffer, _cb) {
     var cb = Util.once(Util.mkAsync(_cb));
     var path = Block.mkPath(Env, publicKey);
diff --git a/lib/workers/index.js b/lib/workers/index.js
index 6371e5929..7b11e7d62 100644
--- a/lib/workers/index.js
+++ b/lib/workers/index.js
@@ -6,6 +6,7 @@ const OS = require("os");
 const { fork } = require('child_process');
 const Workers = module.exports;
 const PID = process.pid;
+const Block = require("../storage/block");
 
 const DB_PATH = 'lib/workers/db-worker';
 const MAX_JOBS = 16;
@@ -457,6 +458,16 @@ Workers.initialize = function (Env, config, _cb) {
         };
 
         Env.validateLoginBlock = function (publicKey, signature, block, cb) {
+            if (!block || !block.length || block.length > Block.MAX_SIZE) {
+                return void setTimeout(function () {
+                    Env.Log.error('E_INVALID_BLOCK_SIZE', {
+                        size: block.length,
+                    });
+
+                    cb('E_INVALID_BLOCK_SIZE');
+                });
+            }
+
             sendCommand({
                 command: 'VALIDATE_LOGIN_BLOCK',
                 publicKey: publicKey,
diff --git a/www/common/common-credential.js b/www/common/common-credential.js
index ffbc482d6..b3be97308 100644
--- a/www/common/common-credential.js
+++ b/www/common/common-credential.js
@@ -3,7 +3,10 @@ var factory = function (AppConfig, Scrypt) {
     var Cred = {};
 
     Cred.MINIMUM_PASSWORD_LENGTH = typeof(AppConfig.minimumPasswordLength) === 'number'?
-        AppConfig.minimumPasswordLength: 8;
+        AppConfig.minimumPasswordLength: 8; // TODO 14 or higher is a decent default for 2023
+
+    Cred.MINIMUM_NAME_LENGTH = 1;
+    Cred.MAXIMUM_NAME_LENGTH = 64;
 
     // https://stackoverflow.com/questions/46155/how-to-validate-an-email-address-in-javascript
     Cred.isEmail = function (email) {
@@ -19,8 +22,12 @@ var factory = function (AppConfig, Scrypt) {
         return typeof(x) === 'string';
     };
 
+    // Maximum username length is enforced at registration time
+    // rather than in this function
+    // in order to maintain backwards compatibility with accounts
+    // that might have already registered with a longer name.
     Cred.isValidUsername = function (name) {
-        return !!(name && isString(name));
+        return !!(isString(name) && name.length >= Cred.MINIMUM_NAME_LENGTH);
     };
 
     Cred.isValidPassword = function (passwd) {
diff --git a/www/common/cryptpad-common.js b/www/common/cryptpad-common.js
index f417a4507..9911a6e72 100644
--- a/www/common/cryptpad-common.js
+++ b/www/common/cryptpad-common.js
@@ -2068,7 +2068,6 @@ define([
         }).nThen(function (waitFor) {
             // Write the new login block
             var temp = {
-                User_name: accountName,
                 User_hash: newHash,
                 edPublic: edPublic,
             };
diff --git a/www/register/main.js b/www/register/main.js
index fa26f38b4..d772c770f 100644
--- a/www/register/main.js
+++ b/www/register/main.js
@@ -48,12 +48,19 @@ define([
 
         var I_REALLY_WANT_TO_USE_MY_EMAIL_FOR_MY_USERNAME = false;
         var br = function () { return h('br'); };
+        Messages.register_nameTooLong = "Usernames must be shorter than {0} characters"; // XXX
 
         var registerClick = function () {
             var uname = $uname.val().trim();
     // trim whitespace surrounding the username since it is otherwise included in key derivation
     // most people won't realize that its presence is significant
             $uname.val(uname);
+            if (uname.length > Cred.MAXIMUM_NAME_LENGTH) {
+                let nameWarning = Messages._getKey('register_nameTooLong', [ Cred.MAXIMUM_NAME_LENGTH ]);
+                return void UI.alert(nameWarning, function () {
+                    registering = false;
+                });
+            }
 
             var passwd = $passwd.val();
             var confirmPassword = $confirm.val();