HTML can express simple constraints without JavaScript.

<label for="message">Message</label>
<textarea
  id="message"
  name="message"
  required
  minlength="20"
  maxlength="1000"
></textarea>

required rejects an empty value. minlength and maxlength define the accepted text length. The browser can block native submission and focus the invalid control.

Choose constraints from the real operation. A 20-character minimum may make sense for a support request, but not for a first name. Arbitrary limits create frustration and can reject legitimate data.

Do not mark every field required. Ask only for what the current task needs. A shorter form is easier to complete, easier to validate, and safer to store.

Whitespace needs a decision. A value containing only spaces may pass a length check. The server can trim where appropriate, then check whether meaningful content remains. Do not trim passwords or other values where spaces may be intentional.

The browser constraint is user feedback, not the final authority. A request can bypass the page. The server must check presence and length again before saving.

Test the empty value, 19 characters, 20 characters, and 1001 characters. Confirm both browser and server use the same boundaries.