diff --git a/app/api/routers/auth.py b/app/api/routers/auth.py
index 99d5c9a..0f3d788 100644
--- a/app/api/routers/auth.py
+++ b/app/api/routers/auth.py
@@ -490,11 +490,12 @@ async def phone_login(req: PhoneLoginRequest, request: Request, db: Database = D
     except sms.SmsError as exc:
         raise HTTPException(status_code=401, detail=str(exc))
 
-    # 手机号唯一：既按「登录名=手机号」查，也按「已绑定手机」查（微信等身份绑了手机的用户）。
-    user = await db.users.find_by_phone(req.phone) or await db.users.get_by_username(req.phone)
+    # 手机号唯一：只按「已绑定手机 phone 列」查（登录名 username 与手机号是独立概念，不互查）。
+    user = await db.users.find_by_phone(req.phone)
     if user is None:
+        # 登录名独立生成（不=手机号），手机号存入 phone 列；用户以短信码登录。
         user = await db.users.create(
-            req.phone, password=secrets.token_hex(16),
+            f"u_{secrets.token_hex(10)}", password=secrets.token_hex(16),
             phone=req.phone, role="opc_member",
             source=_client_source(request, getattr(req, "source", ""), "phone"),
             auth_type="phone", register_ip=_client_ip(request),
@@ -531,7 +532,7 @@ async def wx_login(req: WxLoginRequest, request: Request, db: Database = Depends
         user = await db.users.get_by_wx_openid(openid)
     if user is None:
         user = await db.users.create(
-            f"wx_{openid[:24]}", password=secrets.token_hex(16),
+            f"wx_{secrets.token_hex(10)}", password=secrets.token_hex(16),
             wx_openid=openid if not is_mini else "",
             wx_mini_openid=openid if is_mini else "",
             nickname=str(getattr(req, "nickName", "") or ""),
@@ -657,7 +658,7 @@ async def _find_or_create_wx_user(
     user = await db.users.get_by_wx_openid(openid)
     if user is None:
         user = await db.users.create(
-            f"wx_{openid[:24]}", password=secrets.token_hex(16),
+            f"wx_{secrets.token_hex(10)}", password=secrets.token_hex(16),
             wx_openid=openid, nickname="微信用户",
             role="opc_member",
             source=_client_source(request, "", "wx_openid"), auth_type="wx_openid",
@@ -839,7 +840,7 @@ async def mp_qr_confirm(request: Request, req: MpQrConfirmRequest, db: Database
     user = await db.users.get_by_wx_mini_openid(openid)
     if user is None:
         user = await db.users.create(
-            f"wx_{openid[:24]}", password=secrets.token_hex(16),
+            f"wx_{secrets.token_hex(10)}", password=secrets.token_hex(16),
             wx_mini_openid=openid, nickname="微信小程序用户",
             role="opc_member", source="mini_program", auth_type="wx_openid",
             register_ip=_client_ip(request),