3–17 characters: letters A–Z, digits 0–9, hyphens and underscores. It can’t start or end with a hyphen or underscore, or contain -- or __. Names are stored in capitals, just like in the game. Reserved names, and names that only look like one (ADM1N), are refused, and so are names that look too much like an existing account.

12–16 characters, printable ASCII only (letters, digits, spaces and standard symbols), with at least 6 different characters. It can’t contain your username, be a common password or be a simple sequence like ABCDEFGHIJKL. The game client ignores upper and lower case, so length is what makes a password strong.