\"Please enter a valid name\": form rules that reject millions of real people

The most common ways to stop junk in a name field also stop real people, in large numbers. A field that accepts only the letters A to Z rejects the first name of 14.5% of everyone born in France since 1900: André, René, François, Gérard. In Poland it rejects 13.8% of living people: Małgorzata, Paweł, Michał, Łukasz. A field that does not allow a space or a hyphen rejects 26% of people living in Spain, whose first names are often two words, such as María Carmen and José Antonio.

Smaller rules do smaller but real damage. "A name must contain a vowel" rejects 234,684 Americans named Lynn and 28,934 Britons named Rhys. "At least three letters" rejects 180,870 Americans named Jo. And the word King, which turns up on junk-word lists, is the first name of 36,982 Americans.

We counted this on official first-name records from ten countries, about 600 million people in total. We also ran our own name check over the same records and found false alarms in it, which we have fixed; the details are below. The figures were computed on 13 October 2026.

The rules we tested

These are the checks that show up again and again in form code and validation libraries:

1. Only A–Z: letters without accents, plus apostrophe, hyphen and space.
2. No hyphen, apostrophe or space in the first name.
3. At most 12 characters.
4. Must contain a vowel (a, e, i, o, u, with or without accents).
5. At least 3 characters.

Each counted record is one person: a registered birth in the US, France, the UK, Canada, Ireland, Austria and Norway, and a living resident in Spain, Poland and Switzerland. A rule rejects a person if it rejects their first name exactly as the statistics office recorded it.

Some registers already clean names before publishing. The US records drop accents and hyphens altogether, and the Canadian and UK ones drop accents, so we cannot measure those rules there; the chart marks them n/a. Spain's register drops accents on vowels (Maria, Jose) but keeps the ñ, so its A–Z figure is a lower bound. The real US form has to deal with José, Zoë and Mary-Kate even if the birth statistics do not show them.

Country by country

Who each rule hits, by the largest names:

• Only A–Z: André (712,980 in France), Małgorzata (572,162 in Poland), Bjørn (36,909 in Norway), Jürgen (4,486 in Austria), Éabha (1,920 in Ireland).
• No hyphen or space: Maria Carmen (618,622 in Spain), Jean-Pierre (215,450 in France), Marc-Antoine (5,630 in Canada), Anna-Lena (3,830 in Austria), Amelia-Rose (3,066 in the UK).
• Max 12 characters: Francisco Javier (282,045 in Spain), Jean-François (100,070 in France), Maryelizabeth (2,079 in the US), and Yoruba names such as Oluwadarasimi in the UK.
• Needs a vowel: Lynn, Ty, Brynn, Rhys, Sky, and in Norway Gry and Trym. Rules that count y as a vowel avoid most of these, but not Md, a common abbreviation of Muhammad in UK and Polish records.
• Min 3 letters: Jo, Ty, Ed, Al and Bo in the US; Chinese given names Yu, Yi, Li and Zi everywhere.

The blocklist problem

Lists of banned words are meant to catch "test" and "asdf". Several common entries are real first names in official records:

None of the obvious junk words, such as test, null, asdf or fake, appear as a first name in any of the ten registers. The registers have junk of their own, though. The US files record babies as "Unknown" and "Baby" before they were named; we left those out of every count. Poland's living-population file lists 1,131 people under "Brak Danych", Polish for "no data"; they are in the Polish figures, where they change nothing visible.

Our own name check had false alarms too

Our name check does not use any of the five rules above. It looks for keyboard runs (asdf, qwerty), repeated characters (aaaa, sdfsdf), placeholders, profanity, URLs and digits, and it asks whether the first name appears in official records. Running it over every name in the ten registers showed three mistakes:

• AZERTY. "azer", the start of the French keyboard row, was on the keyboard list. It caught Azer, a common Azerbaijani and Turkish name, as well as Frazer and Lazerrick.
• Repeated syllables. Weiwei, Linlin, Yanyan, Zamzam and Tsitsi are real names in Chinese, Arabic and Shona, and all were marked as repeated characters.
• Small names without a usable count. A name that appears in the records but below the count we use as evidence, such as Azer with 21 US births, was not protected from those checks.

We removed "azer" from the keyboard list (the full "azerty" stays) and stopped applying the keyboard and repetition checks to first names that appear in official records. Junk still gets caught: asdfgh, sdfsdf, aaaaaa and azerty are still marked implausible.

After the fix, our check marks 55 of 371.9 million US records and 31 of 8.9 million Swiss records as implausible, and none in the other eight countries. The remaining cases are deliberate:

• Profanity. Connard (21 people in the US) is a French swear word, and Cono (24 in Switzerland) a Spanish one. We would rather flag a few real people for review than let the word through on a form.
• Placeholders. "No" and "Noname" (18 and 16 people in the US) stay flagged when they are the whole entry.

A softer "suspicious" mark still goes to a few single words that are also organisation or role words, such as General (4,025 people in the US, about half born before 1930), Media and Press. Suspicious is a request to look, not a rejection.

What to do instead

If your form must reject anything, reject what is clearly not a name and let the rest through:

• Accept every letter in Unicode, plus spaces, hyphens and apostrophes. A name field that only takes A–Z is a field that rejects a seventh of France.
• Do not set a minimum length above 1 or a maximum below 50.
• Do not require a vowel.
• Keep blocklists to whole-entry placeholders: "test", "asdf", "n/a", "Test Test", "John Doe". Do not ban words that are also names.
• Flag, do not block. A suspicious name can go to a review queue or get a second question; a blocked name is a customer who cannot sign up.

Related: splitting full names into first, middle and last, company and role names in gender lookups, and salutation errors by country.

Reproducing it

The script is scripts/junk-name-filters.php. It reads the counted name records, applies the five rules and the blocklist, runs our name check on every name, and writes one JSON file with the results and the largest names behind each figure. scripts/junk-name-filters-chart.mjs draws the chart from that file.