I tinkered once with hash of a user's passphrase, salted, and then using 4 digits from the middle of the resulting hash as a username. I then used a different 4

I tinkered once with hash of a user's passphrase, salted, and then using 4 digits from the middle of the resulting hash as a username. I then used a different 4 digits as a cookie token so they only had to enter it once per sesssion. It's not terribly secure, it's not collision-proof, etc, but you may find some use from the basic principle - it's quick and easy and was useful on the scale I needed it for :) Edit: Point of note: The same people who wouldn't type 16 characters of username and password would happily type 30 or 40 character passphrases... There's some novelty to it, apparently :)