A good username is not the same as a strong password
Your username is the public face of your account — it is what other people see, what you type to log in, and what gets stored in databases across the internet. Unlike a password, which should be random and unique, a username needs to be something you can remember and type quickly. The trade-off is that usernames are almost never secret. Someone can see it in a comment you leave, in a video call, or in a shared document. This means your username should not contain information that identifies you in the real world.
The goal is to pick something that is straightforward for you to manage across multiple sites, hard for someone else to guess or impersonate, and safe to use in public. That usually means avoiding your real name, your birth year, your location, or any word that ties back to your actual identity.
Key Takeaways
- Use a username that does not contain your real name, birth year, location, or other identifying details that someone could find about you online.
- Pick something you can type quickly and remember without writing it down, since you will enter it dozens of times a year.
- Use different usernames across different sites so that if one account is breached, an attacker cannot use that username to find your other accounts.
- Avoid usernames that are too similar to your email address, since attackers often try common variations when they have your email.
- Check whether the site allows numbers and special characters before you settle on a username, because some older systems do not.
Why your real name in a username is a security risk
When you use your actual name as a username — or a close variation like "john.smith" or "jsmith1985" — you make it trivial for someone to connect your account to you in the real world. If that account is breached, an attacker now has a username tied to a real person. They can search for that name on other sites, find your other accounts, and try the same password across them. They can also use your name to craft a convincing phishing email or social engineering attack.
The same risk applies to usernames built around your location, workplace, school, or hobbies. "sarah_boston_2024" or "mike_mit_grad" or "alex_loves_hiking" all leak information that makes you easier to target. Someone does not need to know your password if they can guess your username and then reset your account using your email address.
This does not mean you have to use a random string of characters. A username like "bluepine_47" or "silveroak_desk" is memorable, does not identify you, and is different enough from your real name that it does not help an attacker connect the dots.
How to make a username you will actually remember
The best username is one you can type without thinking about it, because you will enter it dozens of times a year. If you have to look it up every time, you will either write it down somewhere unsafe or reuse the same username everywhere — both of which defeat the purpose.
A straightforward formula that works for many people is: adjective + noun + number. Pick an adjective you like (blue, silver, quiet, swift), a concrete noun (pine, oak, desk, river), and a two-digit number that means something to you but is not your birth year or address. "Quietriver_23" or "swiftdesk_41" are both straightforward to remember and type, and they do not identify you.
Another approach is to use a word from a book, song, or movie you know well, plus a number. "Gatsby_47" or "Raven_82" work if you are confident you will remember them in six months. The test is straightforward: close your eyes and try to type it from memory. If you hesitate, pick something else.
Using different usernames across different sites
The single biggest mistake people make is reusing the same username everywhere. If that username gets exposed in a breach at one site, an attacker can use it to search for your account on every other platform. They now have a list of places where you have an account, and they can try the password they stole (or a variation of it) at each one.
You do not need a completely different username at every site, but you should vary them enough that someone cannot easily connect them. If your primary username is "bluepine_47", you might use "bluepine_48" at your bank, "pine_blue_47" at your email, and "bluepine_52" at social media. The variation is small enough that you can remember it, but large enough that a stolen username from one site does not when ready compromise the others.
A password manager like Bitwarden or 1Password can store all your different usernames alongside your passwords, so you do not have to memorize them. You only need to remember the master password to the manager itself.
Usernames that look like email addresses are a trap
Many sites let you use an email address as your username — "sarah@example.com" or just "sarah@example" without the domain. This is convenient because you only have to remember one thing. It is also a security problem, because your email address is often public. Anyone who finds your email can guess that it is also your username on that site.
If you use your email as a username, an attacker who has your email address can try to log in using it, then use the "forgot password" feature to reset your account. They do not need your password at all. Using a separate, non-obvious username makes this attack much harder, because they have to guess both the username and know your email.
The exception is sites where your username is meant to be public — like a social media profile or a forum where people will search for you by name. Even then, you can use a username that is not your email address.
Check the site's rules before you commit to a username
Before you settle on a username, spend 30 seconds checking what characters the site actually allows. Some older banking sites or government portals only accept letters and numbers, not underscores, hyphens, or periods. If you pick "blue-pine_47" and the site strips out the special characters, you end up with "bluepine47" — which might already be taken, or might not be what you intended.
Look for the username field on the sign-up page and read any text below it that says "Usernames can contain..." or "Usernames must be...". Most modern sites accept letters, numbers, underscores, hyphens, and periods. Some allow spaces. A few are very restrictive. Knowing this upfront saves you from having to pick a second choice at the last minute.
Also check the minimum and maximum length. Most sites require at least 3 to 5 characters and cap out at 20 to 30. If you love long usernames, you might hit that ceiling.
What to do if your preferred username is already taken
If "bluepine_47" is taken, your instinct might be to add another number: "bluepine_471" or "bluepine_470". That works, but it makes the username slightly harder to remember. A better approach is to change one of the words: "bluespruce_47" or "silveroak_47" or "bluepine_48". You are still following the same pattern, so it is just as straightforward to remember, but it is a different username.
Avoid the temptation to use a username that is very close to the one you wanted, like "bluepine47" instead of "bluepine_47", because you will confuse yourself when you try to log in. Pick something that feels like a deliberate choice, not a fallback.
Frequently Asked Questions
Should I use my real name as a username if the site is private or invitation-only?
No. Even on private sites, your username can be exposed in a breach, shared in screenshots, or visible to employees of the company. The privacy of the site does not make your real name safer as a username. Use a non-identifying username everywhere.
Is it okay to use the same username at my bank and my social media?
No. If your social media account is breached, an attacker now knows a username that works at your bank. They can try to log in using that username and your email address, then reset your password. Use a different username at your bank, and vary it from your social media username by at least a few characters.
Can I change my username after I create an account?
Most sites let you change your username, but some do not. Check the account settings or help section before you sign up. If you cannot change it later, spend an extra minute picking one you are confident about. If you can change it, you have more freedom to experiment.
What if I forget which username I used at a particular site?
Use your password manager to store it. If you do not use a password manager, write it down in a physical notebook that stays in your home, not in a note-taking app on your phone. When you try to log in, most sites will also let you enter your email address instead of your username, then send you a password reset link — that works even if you forget the username.
Is a username with numbers safer than one with just letters?
Slightly. A username like "bluepine47" is harder to guess than "bluepine" because there are more possible combinations. But the real protection comes from not using your real name or identifying information. "bluepine" is safer than "sarah_boston" even without the number.