Unusual names and passwords

The email field isn’t the only one sign-up forms get wrong. A name with an apostrophe is refused, a Thai name is cut in half, a password with a space is silently trimmed, and <b>Jane</b> ends up bold on the profile page. Proxy Mail QA gives ready-made values for a form’s name and password fields, the way unusual addresses does for the email field, grouped by what the app should do with each.

Where to get them

• An agent: get_name_variants and get_password_variants on the MCP server. The agent types each value into the form and reports what the app did.
• A test: qa.nameVariants() and qa.passwordVariants() in the npm package, name_variants() and password_variants() in the Python helper, or GET /v1/variants/names and GET /v1/variants/passwords on the REST API.
• By hand: New address in the app offers an edge-case first name on the persona; Proxy Mail QA for Chrome offers one on its fill cards, and an edge-case password that fits the field’s own rules.

Each value comes with tests (what it checks) and value (what to type, exactly).

The groups

Group	What it means	What to check
accept	A real person’s name, or a password within the field’s rules	The app takes it as typed, and the account works afterwards
reject	Breaks the field’s own limits: too long, empty, only spaces, a symbol where none are allowed	The app refuses it with a clear message, without creating an account
store_as_text	Looks like code: HTML, a script tag, a SQL injection, a template expression	The app stores and shows it exactly as typed, never runs it
decide	Apps reasonably differ: digits in a name, an emoji, spaces around, only digits in a password	Note what the app did: accepted, rejected, or changed it (trimmed, escaped, cut short)

Names

Pass the field (first_name, last_name, full_name or display_name) and its maximum length when it has one, so the list includes a name exactly that long and one over it.

Group	Values
Accept	O'Brien, Smith-Jones, Mary Ann, J. R., Jean-Luc, D'Angelo, José, Zoë, Ñandú, Søren, Straße, Łukasz, İnci, 李, さくら, 김, Мария, Ελένη, محمد, דוד, प्रिया, สมชาย, one letter, exactly the maximum
Reject	One over the maximum, empty, only spaces
Store as text	<b>Jane</b>, <script>alert(1)</script>, Robert'); DROP TABLE students;--, {{7*7}}, =1+1, Jane%00Doe
Decide	Jane2, 3M, ***, ---, Jane&Co, A/S, Dr., #1, Jane 🌸, a zero-width space inside, spaces before and after, é composed and decomposed, and 64, 128 and 255 characters when no maximum is given

Arabic and Hebrew names are written right to left, Devanagari carries combining marks, and Thai has no spaces between words: each trips a different kind of validation. The composed and decomposed é are the same name in two encodings; an app that doesn’t normalise can store two accounts for one person.

Passwords

Pass the field’s rules: min_length (default 8), max_length (default 64) and whether symbols are allowed (default yes). Every password is made fresh with a secure random generator, so no two calls share one.

Group	Values
Accept	Exactly the minimum, exactly the maximum, and (where symbols are allowed) each class: !@#$%, -_+=, ()[]{}<>, quotes, a backslash, a space inside, éüñ
Reject	One under the minimum, one over the maximum, a symbol where none are allowed
Decide	Only digits, only lower-case letters, a space at the start, a space at the end, an emoji, é composed and decomposed, and when the maximum is over 72, two passwords sharing their first 72 bytes

Set each accepted password with the form, then sign in with it: a password that’s accepted but trimmed, cut short or re-encoded on the way in won’t sign in as typed. bcrypt reads only the first 72 bytes, so the second password of the 72-byte pair must not sign in as the first.

Reporting

Report the results as a table: the value, what it tests, whether the form accepted it, what the app stored (as typed, or changed), and for passwords whether signing in worked. The signup-form-email-validation skill does this for addresses, names and passwords together.

Precautions

• Each accepted value creates a separate account in the app. Test on a staging environment, or delete them afterwards.
• The injection strings are harmless text. They only check the app treats them as text; never run them against an app you don’t own or aren’t allowed to test.
• In a shell, quote the values: ', ", \, &, ;, < and > mean something to it.