'password' should be varchar(40) if you use SHA1 hashes. You do not need utf8 in there at all since you should store passwords as hashes.
'email'... use 255, you cannot know how long someone's email address is.
For the username I'd just use whatever your max username length is. 20 or 30 would probably be good.
Regarding performance, I don't think it makes a big difference. String comparisons are always slow. But if you just select but don't order/filter by those fields (at least not without indexes) the max length doesn't make a big difference.