3-24 characters: letters, numbers, underscores, hyphens

Only used for login and account recovery — never shown to other users

At least 8 characters