diff --git a/internal/db/user.go b/internal/db/user.go
index bff23c8..fc4a0e6 100644
--- a/internal/db/user.go
+++ b/internal/db/user.go
@@ -247,3 +247,7 @@ func (dto *UserDTO) ToUser() *User {
 		Password: dto.Password,
 	}
 }
+
+type UserUsernameDTO struct {
+	Username string `form:"username" validate:"required,max=24,alphanumdash,notreserved"`
+}
diff --git a/internal/web/handlers/settings/account.go b/internal/web/handlers/settings/account.go
index 8ac9d7d..d54cc14 100644
--- a/internal/web/handlers/settings/account.go
+++ b/internal/web/handlers/settings/account.go
@@ -51,11 +51,10 @@ func AccountDeleteProcess(ctx *context.Context) error {
 func UsernameProcess(ctx *context.Context) error {
 	user := ctx.User
 
-	dto := new(db.UserDTO)
+	dto := new(db.UserUsernameDTO)
 	if err := ctx.Bind(dto); err != nil {
 		return ctx.ErrorRes(400, ctx.Tr("error.cannot-bind-data"), err)
 	}
-	dto.Password = user.Password
 
 	if err := ctx.Validate(dto); err != nil {
 		ctx.AddFlash(validator.ValidationMessages(&err, ctx.GetData("locale").(*i18n.Locale)), "error")