diff --git a/api/profiles/profiles.go b/api/profiles/profiles.go
index 905b437..c46d2a2 100644
--- a/api/profiles/profiles.go
+++ b/api/profiles/profiles.go
@@ -11,6 +11,7 @@ import (
 
 const MaxAvatarSize = 1024 * 1024 * 2 // 2MB
 const AvatarPath = "avatars/"
+const AvatarPrefix = "/uploads/avatars/"
 
 func GetProfileContinuation(context *types.RequestContext, req *http.Request, resp http.ResponseWriter) types.ContinuationChain {
 	return func(success types.Continuation, failure types.Continuation) types.ContinuationChain {
@@ -23,7 +24,7 @@ func GetProfileContinuation(context *types.RequestContext, req *http.Request, re
 	}
 }
 
-func UpdateProfileContinuation(fileAdapter files.FilesAdapter, maxAvatarSize int, avatarPath string) func(context *types.RequestContext, req *http.Request, resp http.ResponseWriter) types.ContinuationChain {
+func UpdateProfileContinuation(fileAdapter files.FilesAdapter, maxAvatarSize int, avatarPath string, avatarPrefix string) func(context *types.RequestContext, req *http.Request, resp http.ResponseWriter) types.ContinuationChain {
 	return func(context *types.RequestContext, req *http.Request, resp http.ResponseWriter) types.ContinuationChain {
 		return func(success types.Continuation, failure types.Continuation) types.ContinuationChain {
 			formErrors := types.FormError{
@@ -39,6 +40,9 @@ func UpdateProfileContinuation(fileAdapter files.FilesAdapter, maxAvatarSize int
 
 			if len(formErrors.Errors) == 0 {
 				file, _, err := req.FormFile("avatar")
+				if file == nil {
+					formErrors.Errors = append(formErrors.Errors, "avatar required")
+				}
 				if err != nil {
 					formErrors.Errors = append(formErrors.Errors, "error uploading avatar")
 				} else {
@@ -52,14 +56,24 @@ func UpdateProfileContinuation(fileAdapter files.FilesAdapter, maxAvatarSize int
 				}
 			}
 
-			if len(formErrors.Errors) == 0 {
-				bio := req.FormValue("bio")
-				location := req.FormValue("location")
-				website := req.FormValue("website")
+			bio := req.FormValue("bio")
+			location := req.FormValue("location")
+			website := req.FormValue("website")
+			if len(bio) > 128 {
+				formErrors.Errors = append(formErrors.Errors, "bio too long, keep it to 128")
+			}
+			if len(location) > 32 {
+				formErrors.Errors = append(formErrors.Errors, "location too long, keep it to 32")
+			}
+			if len(website) > 64 {
+				formErrors.Errors = append(formErrors.Errors, "website too long, keep it to 64")
+			}
 
+			if len(formErrors.Errors) == 0 {
 				context.User.Bio = bio
 				context.User.Location = location
 				context.User.Website = website
+				context.User.Avatar = avatarPrefix + context.User.ID
 
 				_, err = database.SaveUser(context.DBConn, context.User)
 				if err != nil {
diff --git a/api/serve.go b/api/serve.go
index 6218d1b..5721cdf 100644
--- a/api/serve.go
+++ b/api/serve.go
@@ -126,7 +126,7 @@ func MakeServer(argv *args.Arguments, dbConn *sql.DB) *http.Server {
 
 	mux.HandleFunc("POST /profile", func(w http.ResponseWriter, r *http.Request) {
 		requestContext := makeRequestContext()
-		LogRequestContinuation(requestContext, r, w)(auth.VerifySessionContinuation, FailurePassingContinuation)(profiles.UpdateProfileContinuation(uploadAdapter, profiles.MaxAvatarSize, profiles.AvatarPath), auth.GoLoginContinuation)(profiles.GetProfileContinuation, FailurePassingContinuation)(template.TemplateContinuation("profile.html", true), FailurePassingContinuation)(LogExecutionTimeContinuation, LogExecutionTimeContinuation)(IdContinuation, IdContinuation)
+		LogRequestContinuation(requestContext, r, w)(auth.VerifySessionContinuation, FailurePassingContinuation)(profiles.UpdateProfileContinuation(uploadAdapter, profiles.MaxAvatarSize, profiles.AvatarPath, profiles.AvatarPrefix), auth.GoLoginContinuation)(profiles.GetProfileContinuation, FailurePassingContinuation)(template.TemplateContinuation("profile.html", true), FailurePassingContinuation)(LogExecutionTimeContinuation, LogExecutionTimeContinuation)(IdContinuation, IdContinuation)
 	})
 
 	mux.HandleFunc("GET /dns", func(w http.ResponseWriter, r *http.Request) {
diff --git a/database/migrate.go b/database/migrate.go
index 04eae72..fbba6ff 100644
--- a/database/migrate.go
+++ b/database/migrate.go
@@ -147,7 +147,7 @@ func MigrateProfiles(dbConn *sql.DB) (*sql.DB, error) {
 	columns["bio"] = "a computer hater"
 	columns["location"] = "earth"
 	columns["website"] = "https://hatecomputers.club"
-	columns["avatar"] = "/files/avatars/default.png"
+	columns["avatar"] = "/static/img/default-avatar.png"
 
 	for column, defaultValue := range columns {
 		if userColumns[column] {
diff --git a/static/img/default-avatar.png b/static/img/default-avatar.png
new file mode 100644
index 0000000..66a38c2
Binary files /dev/null and b/static/img/default-avatar.png differ
diff --git a/templates/home.html b/templates/home.html
index 944216d..09edc20 100644
--- a/templates/home.html
+++ b/templates/home.html
@@ -3,5 +3,6 @@
   <p>current peeps:</p>
   {{ range $user := .Users }}
     <p>{{ $user.Username }}</p>
+    <img src="{{ $user.Avatar }}" alt="{{ $user.Username }}" />
   {{ end }}
 {{ end }}
diff --git a/templates/profile.html b/templates/profile.html
index eb2091c..52f7127 100644
--- a/templates/profile.html
+++ b/templates/profile.html
@@ -4,7 +4,7 @@
 <br>
 <form action="/profile" method="POST" class="form" enctype="multipart/form-data">
   <label for="type">avatar.</label>
-  <input type="file" name="avatar">
+  <input type="file" name="avatar" required>
 
   <label for="type">location.</label>
   <input type="text" name="location" value="{{ .Profile.Location }}">