diff --git a/api/models/User.js b/api/models/User.js
index f797ca5b29..b7f42023eb 100644
--- a/api/models/User.js
+++ b/api/models/User.js
@@ -25,7 +25,7 @@ const userSchema = mongoose.Schema(
       type: String,
       lowercase: true,
       required: [true, "can't be blank"],
-      match: [/^[a-zA-Z0-9_]+$/, 'is invalid'],
+      match: [/^[a-zA-Z0-9_-]+$/, 'is invalid'],
       index: true
     },
     email: {
@@ -45,7 +45,7 @@ const userSchema = mongoose.Schema(
       type: String,
       trim: true,
       minlength: 8,
-      maxlength: 60
+      maxlength: 128
     },
     avatar: {
       type: String,
@@ -162,9 +162,9 @@ module.exports.validateUser = (user) => {
     username: Joi.string()
       .min(2)
       .max(80)
-      .regex(/^[a-zA-Z0-9_]+$/)
+      .regex(/^[a-zA-Z0-9_-]+$/)
       .required(),
-    password: Joi.string().min(8).max(60).allow('').allow(null)
+    password: Joi.string().min(8).max(128).allow('').allow(null)
   };
 
   return schema.validate(user);
diff --git a/api/strategies/openidStrategy.js b/api/strategies/openidStrategy.js
index dfd7aa968e..65b0a3da5c 100644
--- a/api/strategies/openidStrategy.js
+++ b/api/strategies/openidStrategy.js
@@ -77,7 +77,7 @@ Issuer.discover(process.env.OPENID_ISSUER)
               email: userinfo.email || '',
               emailVerified: userinfo.email_verified || false,
               name: fullName
-             });
+            });
           } else {
             user.provider = 'openid';
             user.openidId = userinfo.sub;
diff --git a/api/strategies/validators.js b/api/strategies/validators.js
index 316be4a3c5..db66c44ff3 100644
--- a/api/strategies/validators.js
+++ b/api/strategies/validators.js
@@ -2,7 +2,7 @@ const Joi = require('joi');
 
 const loginSchema = Joi.object().keys({
   email: Joi.string().trim().email().required(),
-  password: Joi.string().trim().min(6).max(20).required()
+  password: Joi.string().trim().min(8).max(128).required()
 });
 
 const registerSchema = Joi.object().keys({
@@ -11,11 +11,11 @@ const registerSchema = Joi.object().keys({
     .trim()
     .min(2)
     .max(20)
-    .regex(/^[a-zA-Z0-9_]+$/)
+    .regex(/^[a-zA-Z0-9_-]+$/)
     .required(),
   email: Joi.string().trim().email().required(),
-  password: Joi.string().trim().min(6).max(20).required(),
-  confirm_password: Joi.string().trim().min(6).max(20).required()
+  password: Joi.string().trim().min(8).max(128).required(),
+  confirm_password: Joi.string().trim().min(8).max(128).required()
 });
 
 module.exports = {
diff --git a/client/src/components/Auth/LoginForm.tsx b/client/src/components/Auth/LoginForm.tsx
index 4da8b507ad..582ab3b21c 100644
--- a/client/src/components/Auth/LoginForm.tsx
+++ b/client/src/components/Auth/LoginForm.tsx
@@ -74,7 +74,7 @@ function LoginForm({ onSubmit }: TLoginFormProps) {
               },
               maxLength: {
                 value: 40,
-                message: 'Password must be less than 40 characters'
+                message: 'Password must be 128 characters or less'
               }
             })}
             aria-invalid={!!errors.password}
diff --git a/client/src/components/Auth/Registration.tsx b/client/src/components/Auth/Registration.tsx
index 4fc7e4746b..1976b35fa2 100644
--- a/client/src/components/Auth/Registration.tsx
+++ b/client/src/components/Auth/Registration.tsx
@@ -187,8 +187,8 @@ function Registration() {
                     message: 'Password must be at least 8 characters'
                   },
                   maxLength: {
-                    value: 40,
-                    message: 'Password must be less than 40 characters'
+                    value: 128,
+                    message: 'Password must be 128 characters or less'
                   }
                 })}
                 aria-invalid={!!errors.password}
@@ -217,11 +217,11 @@ function Registration() {
                 id="confirm_password"
                 data-testid="confirm_password"
                 aria-label="Confirm password"
-                // uncomment to prevent pasting in confirm field
-                onPaste={(e) => {
-                  e.preventDefault();
-                  return false;
-                }}
+                // uncomment to block pasting in confirm field
+                // onPaste={(e) => {
+                //   e.preventDefault();
+                //   return false;
+                // }}
                 {...register('confirm_password', {
                   validate: (value) => value === password || 'Passwords do not match'
                 })}
diff --git a/client/src/components/Auth/ResetPassword.tsx b/client/src/components/Auth/ResetPassword.tsx
index fd41419325..452799fe0f 100644
--- a/client/src/components/Auth/ResetPassword.tsx
+++ b/client/src/components/Auth/ResetPassword.tsx
@@ -94,8 +94,8 @@ function ResetPassword() {
                       message: 'Password must be at least 8 characters'
                     },
                     maxLength: {
-                      value: 40,
-                      message: 'Password must be less than 40 characters'
+                      value: 128,
+                      message: 'Password must be 128 characters or less'
                     }
                   })}
                   aria-invalid={!!errors.password}