title: What are the pros and cons of using an email address as a user id?
body: <p>I'm creating a web app that requires registration/authentication, and I'm considering using an email address as the sole user id. Here are what I see as the pros and cons (updated with responses):</p>
  
  <p><strong>PROS</strong></p>
  
  <ol>
  <li><p>One less field to fill out during registration (it would just be email address, password, and verify password). I'm a big fan of minimalistic registration.</p></li>
  <li><p>An email address is easier to remember. (thanks <a href="https://stackoverflow.com/users/16076/mitch-wheat">Mitch</a>, <a href="https://stackoverflow.com/users/4258/jeremy-kratz">Jeremy</a>)</p></li>
  <li><p>You don't have to worry about your favorite username being taken already - you're the only one who uses your email address. (thanks <a href="https://stackoverflow.com/users/39809/tstamper">TStamper</a>)</p></li>
  </ol>
  
  <p><strong>CONS</strong></p>
  
  <ol>
  <li><p>User has more to type every time they log in.</p></li>
  <li><p>What if a user wants multiple accounts? They'll need another email address. (Do I even want a user to be able to create multiple accounts?)</p></li>
  <li><p>Easy for a potential attacker to guess (if they know the target's email address, they know the login id). (thanks <a href="https://stackoverflow.com/users/7883/vasil">Vasil</a>)</p></li>
  <li><p>Users may be tempted to use the same password they use for their email account, which is bad security. (thanks <a href="https://stackoverflow.com/users/14637/thomas">Thomas</a>)</p></li>
  <li><p>If you change email addresses frequently, it may be difficult to remember which address you used to sign up for a site after a long hiatus. (thanks <a href="https://stackoverflow.com/users/8946/software-monkey">Software Monkey</a>)</p></li>
  <li><p>A hacker could spam the registration form and use "email already taken" responses to generate a list of valid emails. (thanks <a href="https://stackoverflow.com/users/56541/david">David</a>)</p></li>
  <li><p>Not everyone has an email address. (thanks <a href="https://stackoverflow.com/users/32187/nicholas-piasecki">Nicholas</a>)</p></li>
  </ol>
  
  <p>If I went with email as id, I would provide a mechanism to allow it to be changed in the event a user changes address. In this case users would not be posting content to a public site, so a separate username won't be necessary to protect the email addresses (but it is something to consider for other sites).</p>
  
  <p>Another option is to implement OpenID (which is a whole other debate).</p>
  
  <p>This seems to work for Google, but their services are tightly integrated. What have I missed in my analysis? Do you have any recommendations? Does anyone have experiences to share?</p>
  
  <p><strong>FINAL EDIT</strong></p>
  
  <p>Thank you all for your responses. I have decided to use email as an id, but then allow the creation of a username for login purposes after registration. This allows a little flexibility while keeping registration as short as possible. It also prevents problems when a user changes email addresses (they can just log in with their username and update it). I will also be implementing methods to prevent brute-forcing of email addresses out of the registration and login systems (mainly a cool-down period after repeated attempts).</p>