Usernames should probably be limited to a subset of printable ASCII. However, for passwords, you should allow any sequence of bytes (as much as the system can

Usernames should probably be limited to a subset of printable ASCII. However, for passwords, you should allow any sequence of bytes (as much as the system can support it, which it should allow any sequence since they should be hashed anyways), and the maximum length should be sufficiently long (and don't truncate passwords either).