Start with a name that does not reveal who you are

The single biggest mistake people make is using their real name, birth year, or a combination of both. A username like "JohnSmith1987" or "Sarah_M_1995" tells anyone watching exactly who you are and how old you are. That information follows you across websites and makes it straightforward for someone to find your other accounts, build a profile of your habits, or target you specifically.

Instead, pick something that has no connection to your actual identity. Use a made-up word, a character name from a book or game you like, or a random combination that means something only to you. "BlueThornStudio" or "MidnightGarden42" tells a stranger nothing about who sits behind the screen. The goal is to create a wall between your real life and your online presence.

If you already use your real name somewhere and cannot change it, at least do not repeat that username on new accounts. Each account should have its own identity, so someone who finds you on one site cannot automatically find you everywhere else.

Key Takeaways

  • Avoid your real name, birth year, and any personal details — use made-up words or character names instead so strangers cannot identify you.
  • Use a different username on each website so someone who finds you in one place cannot automatically locate all your other accounts.
  • Pick something you can remember without writing it down, or store it in a password manager alongside your login details.
  • Check that the username is actually available before you fall in love with it — many sites show you when ready, but some require you to start the full signup to find out.
  • Avoid usernames with numbers at the end that look like birth years, phone numbers, or addresses, since those reveal information about you.

Make it long enough that it is hard to guess

A short username is easier to remember but much easier to guess or steal. Someone trying to break into your account will start with obvious combinations: your first name, your pet's name, common words. A username that is at least eight characters long and mixes letters, numbers, and sometimes symbols makes that guessing much harder.

The length matters more than complexity. "BlueThorn" is better than "Blue1" even though the second one has a number. "MidnightGardenPath" is better than "M!dN!ght" because it is longer and the attacker has to guess more characters. You do not need special symbols if your username is genuinely long and random.

Avoid patterns that look deliberate. "Password123" or "Admin456" are common enough that attackers try them first. A username that looks like a random phrase — "SnowflakePencilTree" or "GreenCarpetWalrus" — is much harder to predict even if someone knows you.

Check availability before you get attached to it

The moment you decide on a username, check whether it is actually available on the sites where you plan to use it. Some websites have a search box on the signup page that tells you when ready. Others make you fill out the entire form before telling you the name is taken. A few do not tell you until you try to log in later.

If your first choice is taken, do not just add "1" or "2" to the end. That makes your username shorter and easier to guess. Instead, change the word itself. If "BlueThornStudio" is taken, try "BlueThornWorkshop" or "ThornBlueStudio" rather than "BlueThornStudio1". The goal is to keep the username long and random-looking.

Write down your final username and password in a password manager like Bitwarden, 1Password, or the password manager built into your browser. Do not write it on paper or in a notes app on your phone. A password manager keeps both pieces of information encrypted and in one place, so you can retrieve them when you need them without memorizing anything.

Avoid usernames that sound like official accounts

Do not use a username that looks like you work for a company or government agency. Usernames like "PayPalSupport," "AmazonHelp," or "IRSAssistant" are impersonation, and they can get your account suspended or reported. They also confuse people who think you are actually representing that organization.

The same rule applies to usernames that sound like you are an admin or moderator on a site where you are just a regular user. "SiteAdmin" or "ModeratorTeam" will get you flagged. Stick to something that clearly belongs to a person, not a role.

Do not use the same username everywhere

Many people use one username across every website they join — email, social media, banking, forums, shopping. That is a security mistake. If someone finds your username on one site and figures out your password, they can try that same combination on every other site. If you use the same username and password everywhere, one breach gives them access to everything.

Create a different username for each category of account. Use one for social media, another for banking and financial sites, another for shopping, another for forums or gaming. That way, if one account is compromised, the others stay safe. A password manager makes this straightforward because it stores each username and password pair separately and fills them in automatically.

At minimum, use a different username for accounts that hold money or sensitive information — banking, email, shopping sites with saved payment methods. Social media and forums can share a username if you want, since the damage from a breach is less severe.

Test it before you commit

Before you finalize a username on an important account, say it out loud or type it a few times. Make sure you can spell it consistently and remember it without looking it up every time. If you have to check a note every time you log in, you picked something too complicated.

Also search for the username online to see what comes up. If there is already a well-known person or account with that name, you might get confused with them or have trouble if you ever need to contact customer support. A unique username that belongs only to you is easier to manage.

Once you have created the account, test logging out and logging back in using only the username and password you wrote down. Do not rely on "remember me" or autofill. Make sure you can actually access the account with the credentials you chose. If something does not work, fix it now while you still have access, not later when you are locked out.

Frequently Asked Questions

Can I change my username later if I do not like it?

Most websites let you change your username, but some do not. Check the account settings or help section before you create the account. If you cannot change it later, pick carefully the first time. On sites that do allow changes, you usually have to wait a certain number of days between changes to prevent abuse.

Should I use my email address as my username?

No. Your email address is already public in many places, and using it as a username ties your real identity to that account. Use a separate username instead and keep your email address private. Most sites ask for your email separately anyway, so you do not need to use it as your username.

What if someone else is using a username I want?

Try a variation: add a word before or after it, change one word to a synonym, or pick a completely different username. Do not add numbers that look like a birth year or address. If the username is important to you on a specific platform, contact that site's support team to ask if the account is active — some sites let you claim abandoned usernames after a long period of inactivity.

Is it okay to use special characters like underscores or hyphens?

Yes, but check first whether the site accepts them. Some websites only allow letters and numbers in usernames. Others accept underscores, hyphens, or periods. Special characters can make a username harder to guess, but they also make it harder to type correctly every time you log in. Keep it straightforward if you can.

Should I use different usernames for work and personal accounts?

Yes. Use a professional username for work email and work-related sites, and a separate personal username for everything else. This keeps your work identity separate from your personal life and prevents coworkers from finding your personal accounts or vice versa. It also protects you if you change jobs.