Start with a base that's hard to guess but straightforward for you to remember

A good username does two things at once: it keeps your account safer and it stays in your head without a password manager. The safest usernames avoid anything publicly connected to you — no birth year, no pet name, no hometown. Someone who finds your social media or knows you personally should not be able to guess it in three tries.

The easiest way to build this is to combine two unrelated words or a word plus a number that means something only to you. "Bluestone" is better than "Sarah1985". "Marble_Compass" is better than "SarahM". The number or second word should be something you'll remember without writing down, but something that has no connection to your public identity.

Avoid sequences like "123" or "abc" at the end — these are the first things someone guessing will try. If you need a number, pick one that's meaningful to you but not your birthday or address. A childhood favorite number, a year you remember for a personal reason, or even a number from a book you like works well.

Key Takeaways

  • Use two unrelated words or a word plus a meaningful number instead of your real name, birth year, or information someone could find online.
  • Make it long enough that you can type it without thinking, but not so long that you'll mistype it half the time — 12 to 16 characters is usually the sweet spot.
  • Check whether the site allows underscores, periods, or numbers before you settle on a username, since different platforms have different rules.
  • Never reuse the same username across banking, email, and social media accounts, because a breach at one site puts all of them at risk.
  • Test your username by searching for it online before you commit — if it's already tied to someone else's public profile, pick something different.

Length matters more than you think

A username that's too short is straightforward to guess; one that's too long is straightforward to mistype. Aim for 12 to 16 characters. This is long enough that random guessing becomes impractical, but short enough that you can type it without looking at the keyboard or second-guessing yourself.

If a site forces you to choose something shorter — say, 8 characters — make those characters count. Use a mix of uppercase and lowercase if the site allows it. "BlueStone" is stronger than "bluestone" because it's harder to guess the exact capitalization. If the site doesn't allow uppercase, add a number in the middle rather than at the end: "blue7stone" instead of "bluestone7".

Know what characters your accounts actually accept

Before you fall in love with a username, check what the site allows. Some sites accept only letters and numbers. Others allow underscores or periods but not hyphens. A few allow special characters like exclamation marks or dollar signs, but these are rare for account usernames (more common in email addresses).

The safest approach is to build your username from letters, numbers, and underscores only. These work on almost every platform. If you want to use a period or hyphen, test it on the site first. Write down exactly what you chose — "Blue_Stone" is different from "Blue.Stone" and different from "BlueStone", and you'll need to remember which one you used.

Never use the same username across different types of accounts

Your email username, your banking username, and your social media username should be completely different. If someone breaks into your social media account and finds out your username is "BlueStone", they now know to try "BlueStone" at your bank. They'll try it at Gmail. They'll try it everywhere.

This is why password managers are useful — they can store different usernames for different sites, so you don't have to remember them all. But even without a password manager, you can keep three or four different usernames in your head. Use one for financial accounts, one for email, one for social media, and one for everything else. The effort of remembering four usernames is worth the protection it gives you.

Search for your username before you use it

Type your chosen username into Google, DuckDuckGo, or your search engine of choice. If it pulls up someone else's public profile, pick something different. You want a username that's not already tied to another person online, because it makes you harder to find by accident and harder to impersonate.

This is especially important if you're choosing a username for banking, email, or any account tied to money. A unique username means someone can't easily create a fake account pretending to be you on another platform. It also means you won't get confused with someone else if your username comes up in a data breach — the breach report will be about them, not you.

Avoid patterns that look like they're trying too hard

Usernames like "XxBlueStoneXx" or "BlueStone_420" or "BlueStone!!!" look like they were chosen by someone trying to be cool online. They're also easier to guess because they follow predictable patterns. The "Xx" wrapper, the number 420, the repeated punctuation — these are things someone guessing will try early.

A username that looks boring and ordinary is actually safer. "BlueStone" beats "XxBlueStoneXx" every time. "Marble_Compass" beats "Marble_Compass_ELITE". The goal is to be forgettable to strangers and memorable only to you.

Test it for typos before you commit

Type your username five times in a row, as fast as you normally would. Did you get it right all five times? If you hesitated or made a mistake even once, it's too complicated. Go back and simplify it.

The username you choose is one you'll type dozens of times a month. If it requires you to think about capitalization, remember where the underscore goes, or count the number of letters, you'll eventually lock yourself out by mistyping it. Test it on paper or in a text file first. Type it fast, type it slow, type it when you're distracted. If you can do all three without error, you've got a good one.

Frequently Asked Questions

Should I use my real name in my username?

Not for accounts that hold sensitive information like banking, email, or health records. For social media where you want people to find you, a real name or part of one is fine. But keep your financial and email usernames completely separate from anything with your actual name in it.

What if the username I want is already taken?

Add a number or underscore to make it unique. "BlueStone" taken? Try "BlueStone_7" or "BlueStone88". Avoid just adding numbers to the end in order (BlueStone1, BlueStone2) — that's predictable. Pick a number that means something to you and stick with it across sites where you use similar base usernames.

Can I change my username later?

Most sites let you change your username, but some don't. Check the site's settings before you commit. If you can't change it later, spend extra time choosing one you'll be happy with for years. If you can change it, you have more freedom to experiment.

Is it okay to write my username down?

Write it down in a password manager or a locked notebook, not on a sticky note on your monitor. The username itself is less sensitive than your password, but it's still part of your account security. Keep it somewhere safe but accessible enough that you can look it up if you forget.

Should my username give any hint about what the account is for?

No. "BankUser" or "EmailAccount" tells someone exactly what they're looking at if they see your username in a data breach. A random-looking username like "BlueStone" or "Marble_Compass" gives away nothing about what the account does, which is safer.