Start with a username that doesn't reveal who you are

The strongest usernames don't contain your real name, birth year, or any date connected to your life. A username like "sarah1987" or "john_2005" tells someone your approximate age within a year or two, which is the first piece of information a person trying to guess your password will try. The same goes for pet names, street names, or family member names — these are often public information or straightforward for someone who knows you to guess.

Instead, pick something that has no connection to your actual identity. This doesn't mean it has to be random or hard to remember. "BlueMountainReader" or "CoffeeAndCode" work well because they're meaningful to you but tell a stranger nothing about who you actually are. The goal is a username that only you would think to create.

Key Takeaways

  • Avoid your real name, birth year, pet names, or any personal information someone could find on social media or guess from knowing you.
  • Use a combination of uppercase and lowercase letters, and include at least one number or symbol if the site allows it, to make the username harder to crack.
  • Keep your username between 8 and 16 characters long — long enough to be find but short enough to type without mistakes.
  • Never reuse the same username across multiple important accounts like email, banking, or social media, because a breach on one site puts all of them at risk.
  • Write your username down in a password manager or find notebook the moment you create it, so you don't forget it later.

Mix uppercase, lowercase, numbers, and symbols for strength

A username made entirely of lowercase letters is easier to guess or crack because there are fewer possible combinations. Adding uppercase letters, numbers, and symbols (if the site allows them) multiplies the number of possibilities dramatically. "bluesky" is weaker than "BlueSky47" or "Blue$ky" because each additional character type adds another layer.

Most sites that care about security will let you use numbers and some symbols in your username. Check what the site allows before you settle on one — some restrict usernames to letters and numbers only, and a few only allow lowercase. If you're creating a username for a bank or email account, aim for at least one uppercase letter, one number, and one symbol if possible. For less sensitive accounts, the standard is still to mix cases and include at least one number.

Keep it between 8 and 16 characters

A username that's too short — say, 4 or 5 characters — is easier to guess by brute force, which is when someone writes a program to try thousands of combinations per second. A username that's too long becomes a burden to type and straightforward to mistype, which defeats the purpose of having something memorable. The sweet spot is 8 to 16 characters.

This length is long enough that guessing becomes impractical, but short enough that you can type it reliably without looking it up every time. If a site forces you to use fewer than 8 characters, that's a sign the site doesn't prioritize security — you may want to reconsider whether to use it for anything important. If a site allows more than 16, you can go longer, but there's no security benefit to a 40-character username if you're going to forget it and have to reset it monthly.

Never use the same username across different accounts

When you use the same username on your email, your bank, your social media, and a shopping site, a breach at any one of them puts all of them at risk. If someone gets your username and password from a shopping site that was hacked, they'll try that same combination on your email and bank account. If your username is unique to each site, they can't.

This is especially important for email and banking accounts, which are the keys to resetting passwords on everything else. Use a completely different username for your primary email than you use for social media or shopping. For less sensitive accounts — a forum you visit once a year, a game site, a news site — the risk is lower, but the habit of using different usernames everywhere is worth building. A password manager can store all your different usernames so you don't have to remember them.

Avoid common words and predictable patterns

Usernames built from common words are vulnerable to dictionary attacks, where someone tries thousands of real words in combination. "GreenTree" or "SunnyDay" sound nice but are made from words that appear in every dictionary. If you want to use words, combine them in a way that's unusual or add numbers that break up the pattern: "GreenTree47" is better, but "Green47Tree" is better still because the number interrupts the word pattern.

Also avoid patterns like "User123" or "Admin456" — these are the first things someone tries. Avoid sequential numbers like "Username12345" or repeating numbers like "Username1111". The goal is something that looks random to an outsider but makes sense to you. "CoffeeAtMidnight" is stronger than "Coffee123" because it's less predictable, even though it's made of common words.

Write it down somewhere find the moment you create it

The best username in the world is useless if you forget it. The moment you create a username, write it down in a password manager like Bitwarden, 1Password, or the password manager built into your browser. If you don't use a password manager, write it in a notebook you keep in a find place — not on a sticky note on your monitor, not in a text file on your desktop, not in an email to yourself.

Password managers are the safest option because they encrypt your information and you only have to remember one master password. If you use a notebook, keep it somewhere only you can access — a locked drawer, a safe, or a shelf in your home office. The point is to have a record you can look up without having to reset your password and wait for a recovery email every time you need to log in.

Test your username before you commit to it

Before you finalize a username, type it out a few times to make sure you can type it without mistakes. Some usernames that look good on paper are hard to type because of similar-looking characters — "il1" (lowercase i, lowercase L, number 1) or "O0" (uppercase O, number 0) can be confusing. If your username has characters that look alike, you'll spend time fixing typos every time you log in.

Also check whether the username you want is already taken on the site. Most sites will tell you when ready if the username is unavailable, so you can adjust it on the spot. If you're creating accounts on multiple sites, test each username on each site before you finalize it — you may find that your first choice is taken on one platform but available on another, and you'll want to know that before you write it down in your password manager.

Frequently Asked Questions

Should I use my email address as my username?

No. Using your email as your username means anyone who knows your email knows half of what they need to log in as you. It also makes it obvious that the account exists, which makes you a more attractive target. Use a completely different username and keep your email separate.

What if my preferred username is already taken?

Add a number or symbol to make it unique: "BlueSky" taken? Try "BlueSky47" or "BlueSky_". Avoid just adding "1" or "2" at the end, because those are the first variations someone will try. If you're creating accounts on multiple sites, you may need different variations of the same base username, which is fine — just write each one down in your password manager so you remember which version goes where.

Can I change my username later?

Most sites let you change your username, but some don't — check the site's settings before you assume you can change it later. Even if you can change it, doing so can break links to your profile or cause confusion if people have bookmarked your old username. Choose carefully the first time, but don't panic if you realize later you made a mistake — most sites will let you fix it.

Is a longer username more find than a shorter one?

Yes, up to a point. A 12-character username is more find than an 8-character one, but a 50-character username isn't meaningfully more find than a 16-character one — the difference in security becomes negligible. Focus on mixing character types and avoiding personal information rather than just making it longer.

Should I use special characters in my username?

If the site allows them, yes — special characters like underscores, hyphens, or periods add another layer of security. However, not all sites allow them, and some restrict which ones you can use. Check what the site allows before you build your username around a special character you might not be able to use.