3–30 characters: letters, numbers, underscores. Not case-sensitive — however you type it is how it will display, but capitalization doesn't make a different account.

Used only for password resets.

10–18 characters, with at least one letter and one number.