---
title: "Unusual names and passwords | Proxy Mail QA"
description: "Test what your sign-up form does with awkward names and passwords: apostrophes, other scripts, very long names, each symbol class, and the field's limits."
url: https://proxymail.qa/docs/unusual-names-and-passwords
---

# Unusual names and passwords

The email field isn’t the only one sign-up forms get wrong. A name with an apostrophe is refused, a Thai name is cut in half, a password with a space is silently trimmed, and `<b>Jane</b>` ends up bold on the profile page. Proxy Mail QA gives ready-made values for a form’s name and password fields, the way [unusual addresses](https://proxymail.qa/docs/unusual-addresses) does for the email field, grouped by what the app should do with each.

## Where to get them

- **An agent:** `get_name_variants` and `get_password_variants` on the [MCP server](https://proxymail.qa/docs/mcp). The agent types each value into the form and reports what the app did.
- **A test:** `qa.nameVariants()` and `qa.passwordVariants()` in the [npm package](https://proxymail.qa/docs/node), `name_variants()` and `password_variants()` in the [Python helper](https://proxymail.qa/docs/python), or `GET /v1/variants/names` and `GET /v1/variants/passwords` on the [REST API](https://proxymail.qa/docs/rest-api).
- **By hand:** New address in the app offers an edge-case first name on the persona; [Proxy Mail QA for Chrome](https://proxymail.qa/chrome-extension) offers one on its fill cards, and an edge-case password that fits the field’s own rules.

Each value comes with `tests` (what it checks) and `value` (what to type, exactly).

## The groups

| Group           | What it means                                                                                | What to check                                                                          |
| --------------- | -------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
| accept          | A real person’s name, or a password within the field’s rules                                 | The app takes it as typed, and the account works afterwards                            |
| reject          | Breaks the field’s own limits: too long, empty, only spaces, a symbol where none are allowed | The app refuses it with a clear message, without creating an account                   |
| store\_as\_text | Looks like code: HTML, a script tag, a SQL injection, a template expression                  | The app stores and shows it exactly as typed, never runs it                            |
| decide          | Apps reasonably differ: digits in a name, an emoji, spaces around, only digits in a password | Note what the app did: accepted, rejected, or changed it (trimmed, escaped, cut short) |

## Names

Pass the field (`first_name`, `last_name`, `full_name` or `display_name`) and its maximum length when it has one, so the list includes a name exactly that long and one over it.

| Group         | Values                                                                                                                                                                                          |
| ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Accept        | O'Brien, Smith-Jones, Mary Ann, J. R., Jean-Luc, D'Angelo, José, Zoë, Ñandú, Søren, Straße, Łukasz, İnci, 李, さくら, 김, Мария, Ελένη, محمد, דוד, प्रिया, สมชาย, one letter, exactly the maximum    |
| Reject        | One over the maximum, empty, only spaces                                                                                                                                                        |
| Store as text | <b>Jane</b>, <script>alert(1)</script>, Robert'); DROP TABLE students;--, {{7\*7}}, \=1+1, Jane%00Doe                                                                                           |
| Decide        | Jane2, 3M, \*\*\*, \---, Jane&Co, A/S, Dr., #1, Jane 🌸, a zero-width space inside, spaces before and after, é composed and decomposed, and 64, 128 and 255 characters when no maximum is given |

Arabic and Hebrew names are written right to left, Devanagari carries combining marks, and Thai has no spaces between words: each trips a different kind of validation. The composed and decomposed `é` are the same name in two encodings; an app that doesn’t normalise can store two accounts for one person.

## Passwords

Pass the field’s rules: `min_length` (default 8), `max_length` (default 64) and whether `symbols` are allowed (default yes). Every password is made fresh with a secure random generator, so no two calls share one.

| Group  | Values                                                                                                                                                                                           |
| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Accept | Exactly the minimum, exactly the maximum, and (where symbols are allowed) each class: !@#$%, \-\_+=, ()\[\]{}<>, quotes, a backslash, a space inside, éüñ                                        |
| Reject | One under the minimum, one over the maximum, a symbol where none are allowed                                                                                                                     |
| Decide | Only digits, only lower-case letters, a space at the start, a space at the end, an emoji, é composed and decomposed, and when the maximum is over 72, two passwords sharing their first 72 bytes |

Set each accepted password with the form, then sign in with it: a password that’s accepted but trimmed, cut short or re-encoded on the way in won’t sign in as typed. bcrypt reads only the first 72 bytes, so the second password of the 72-byte pair must not sign in as the first.

## Reporting

Report the results as a table: the value, what it tests, whether the form accepted it, what the app stored (as typed, or changed), and for passwords whether signing in worked. The `signup-form-email-validation` [skill](https://proxymail.qa/skills) does this for addresses, names and passwords together.

## Precautions

- Each accepted value creates a separate account in the app. Test on a staging environment, or delete them afterwards.
- The injection strings are harmless text. They only check the app treats them as text; never run them against an app you don’t own or aren’t allowed to test.
- In a shell, quote the values: `'`, `"`, `\`, `&`, `;`, `<` and `>` mean something to it.

[Previous Unusual email addresses](https://proxymail.qa/docs/unusual-addresses.html) [Next Limits and safety](https://proxymail.qa/docs/limits.html)

- [English ](https://proxymail.qa/docs/unusual-names-and-passwords)
- [Deutsch](https://proxymail.qa/de/docs/unusual-names-and-passwords)
- [Español](https://proxymail.qa/es/docs/unusual-names-and-passwords)
- [Français](https://proxymail.qa/fr/docs/unusual-names-and-passwords)
- [日本語](https://proxymail.qa/jp/docs/unusual-names-and-passwords)
- [简体中文](https://proxymail.qa/zh-cn/docs/unusual-names-and-passwords)