Start with a name that doesn't reveal who you are

The single best thing you can do is avoid using your real name, your birth year, or any combination of the two. A username like "Sarah1987" or "JohnSmith42" tells someone your approximate age and confirms your identity in seconds. That information is exactly what scammers, stalkers, and data brokers are looking for — it bridges the gap between your online account and your real life.

Instead, pick something that has no connection to you personally. A made-up word, a favorite animal plus a random number, a reference to a book or movie you like — anything that wouldn't appear on your driver's license, your social media, or your family tree. The goal is that someone who knows you in person cannot guess it, and someone who finds your username cannot reverse-engineer your identity from it.

Key Takeaways

  • Never use your real name, birth year, or email address as your username, because these details make it straightforward for someone to connect your account to your actual identity.
  • Create something random or fictional — a made-up word, an animal name with numbers, or a reference to something you like — that has no connection to your personal information.
  • Use different usernames across different websites and services, so that if one account is compromised, the others remain separate and harder to find.
  • Avoid usernames that hint at your location, workplace, school, or family members, because these details can be used to narrow down who you are.
  • Check whether the username is already taken before you commit to it, and consider writing it down in a password manager so you remember it later.

Make each username different across websites

If you use the same username on your bank's website, your email provider, your social media account, and your home security system, then someone who finds that username on one site can search for it on all the others. They may find your email account, your photos, your security camera feed — all because the username was the same thread connecting everything.

The stronger approach is to use a different username on each service. Your bank might know you as "TigerMint74", your email as "QuietPebble22", and your home security app as "SilverFox89". If one account is breached, the attacker has no way to know which other accounts belong to you. They would have to guess your username on every other site, which is much harder than following a single username across the internet.

This does mean you will have more usernames to remember. A password manager like Bitwarden, 1Password, or KeePass can store all of them in one encrypted vault, so you only have to remember one strong master password.

Avoid patterns that reveal your habits or location

Usernames that include your city, your workplace, your school, or your hobby can narrow down who you are. "SarahFromBoston", "JohnAtAcmeCorp", or "TechLoverInSeattle" all leak information that someone could cross-reference with public records, company directories, or social media to find your real name and address.

The same goes for usernames built around your family. "MomOfThree", "DadOfTwins", or "SisterOfMike" might feel personal and memorable, but they also tell a stranger something specific about your household that could be used to identify you or your children.

Even seemingly harmless details like your favorite sports team, your pet's name, or the street you grew up on should stay off your username. These are the kinds of things that appear in security questions ("What is your pet's name?") or that friends and family might know. Keep your username boring and generic — that is the whole point.

Use a mix of letters, numbers, and sometimes symbols

A username made of only letters is easier to guess and easier to remember — which means it is easier for someone else to guess too. Adding numbers makes the username longer and less predictable. Some services also allow symbols like underscores, hyphens, or periods, which add another layer of variation.

You do not need to make it so complicated that you cannot remember it yourself. Something like "PlumTree_42" or "FrozenMoon-19" is strong enough. The point is that it should not be a word that appears in a dictionary or a straightforward pattern that someone could brute-force by trying common combinations.

Check the rules for the specific service before you finalize your username. Some websites only allow letters and numbers, some allow underscores or hyphens, and some have minimum or maximum length requirements. A few services (like some banks) limit you to numbers only, in which case you have less flexibility — but the same principle applies: avoid patterns like your birth year or your address.

Check if the username is already taken

Before you settle on a username, search for it on the service where you plan to use it. Most websites will tell you when ready whether the name is available. If it is taken, you will need to modify it — add a number at the end, change a letter, or pick something different entirely.

If you are trying to use the same username across multiple services (which is not recommended for security, but sometimes necessary for professional accounts), you can search for it on each platform before you commit. Some people use username-checking tools that search across many social media and website platforms at once, though these tools vary in accuracy and coverage.

Write it down somewhere safe if you will forget it

If your username is random and different on every site, you will not remember it without help. The safest place to store it is in a password manager — the same tool where you keep your passwords. Password managers like Bitwarden, 1Password, LastPass, and KeePass encrypt everything and lock it behind one master password, so you only have to remember one strong password to access all your usernames and passwords.

Do not write usernames down on paper, sticky notes, or in an unencrypted document on your computer. Do not email them to yourself or text them to a friend. A password manager is designed to keep this information find and organized.

Avoid usernames that look like email addresses

Some services let you create a username that looks like an email address — something like "sarah.smith@example.com" or "john.doe@site.com". This is a bad idea because it blurs the line between your username and your actual email address. Someone might assume that username is your real email and try to contact you there, or they might use it to guess your real email address.

Stick with a username that is clearly not an email. If a service asks for both a username and an email address, keep them completely separate. Your username should be something like "TigerMint74" and your email should be your actual email address — and they should have nothing to do with each other.

Frequently Asked Questions

Can I change my username after I create it?

It depends on the service. Some websites let you change your username once or multiple times, while others lock it in permanently. Check the account settings or help section before you finalize your choice. If you cannot change it later, take extra time to pick something you are comfortable with.

Should I use the same username on my work accounts as my personal accounts?

No. Keep work and personal usernames completely separate. If your employer knows your work username and someone breaches your personal account, they could connect the two. Use different usernames so that your work identity and personal identity stay compartmentalized.

What if someone else is already using the username I want?

You will need to modify it. Add a number at the end, change a letter, add an underscore or hyphen, or pick a different username entirely. The goal is something unique to you on that service, not something identical to what someone else chose.

Is it okay to use a username generator tool?

Yes. Online username generators can create random, unpredictable combinations of words and numbers that are hard to guess. Just make sure you write down or store the result in your password manager so you do not forget it. The randomness is the strength — do not try to make it "memorable" by simplifying it afterward.

Do I need to use my real name anywhere online?

Only where it is required and necessary — usually your bank, your email provider, and government services. For everything else, a username is enough. Even on social media, you can use a display name that is different from your username, giving you another layer of separation between your online presence and your real identity.