Start with a name that does not reveal who you are
The safest usernames contain no real information about you — not your actual name, not your birth year, not your location, and not words connected to your job or family. A username like "sarah_1987_denver" or "mike_accountant" tells someone your approximate age, where you live, and what you do. That information can be used to guess your passwords, find you on other sites, or target you with scams.
Instead, pick something random or abstract. "Bluebell_Compass" or "Neon_Badger" or "Cipher_7" work well because they have no connection to your actual life. The goal is to create a username that only you know is yours — something that would not help someone piece together who you are if they found it on a public forum or a leaked password list.
If you already use usernames tied to your real identity on social media or email, do not reuse those same names for banking, housing, or shopping sites. Keep your financial and personal accounts separate from your public-facing ones.
Key Takeaways
- Avoid usernames that include your real name, birth year, location, or job title, because this information helps attackers guess your passwords or find you across multiple sites.
- Random or abstract usernames like "Cipher_7" or "Bluebell_Compass" are harder to crack and do not leak personal details.
- Use different usernames for different types of accounts — keep your banking username completely separate from your social media username.
- Longer usernames (10+ characters mixing letters and numbers) are generally harder to guess than short ones, but randomness matters more than length.
- Never use a username that matches an email address you use elsewhere, because email addresses are often public and can be searched.
Make it random, not memorable
People often choose usernames they can remember easily — their pet's name, their favorite movie character, their street address. But anything memorable to you is also guessable by someone who knows you or has researched you online. A person who finds your social media can see your pet's name, your favorite books, your hometown. They can then try those as usernames on banking sites.
The best usernames are ones you cannot remember without writing them down. Use a password manager (like Bitwarden, 1Password, or KeePass) to store both your username and password together. This way you do not have to memorize it, and you can make it as random as you want. A password manager also prevents you from reusing the same username across multiple sites, which is a major security risk.
If you must choose something you can remember, combine unrelated words with numbers: "Purple_Elephant_42" or "Frozen_Keyboard_891". The randomness of the combination is what makes it hard to guess, not the fact that each word is a real word.
Avoid usernames that match your email address
Email addresses are often public. They appear on company websites, in directory listings, in forum posts, and in leaked data. If your username is the same as your email address, anyone who finds your email can when ready try it as your username on other sites.
For example, if your email is "sarah.chen@gmail.com" and you use "sarah.chen" as your username on your bank's website, an attacker who has your email address can try that username right away. They do not have to guess or research — they already have it.
Instead, use a completely different username for each account type. Your email stays your email. Your banking username is something else entirely. Your housing portal username is something else again. This separation means that if one site is breached and your username is leaked, it does not automatically compromise your other accounts.
Keep it different across different sites
Reusing the same username on multiple sites is a common mistake. If you use "JennyBlue_22" on your email, your bank, your housing portal, and three shopping sites, then a breach at any one of those sites exposes your username everywhere. An attacker can then try that username with common passwords on all the other sites you use.
This is called username enumeration — an attacker uses a leaked username to test whether you have an account on other platforms. The more sites that share your username, the more places they can attack.
Use a different username for each account. Your password manager can store all of them. You only have to remember the master password to your password manager, and it fills in the rest. This approach takes a few extra minutes to set up but makes it much harder for attackers to target you across multiple sites.
Use length and variety to make guessing harder
A longer username is harder to crack through brute force (trying every possible combination). Aim for at least 10 characters if the site allows it. Mix uppercase letters, lowercase letters, and numbers. Some sites allow special characters like underscores or hyphens — use them if you can.
For example, "BlueBadger_7" (12 characters) is harder to guess than "BlueBadger" (10 characters), and both are harder than "Blue" (4 characters). But again, randomness matters more than length. A 20-character username that is your name spelled out backwards is still guessable. A 10-character random string is much safer.
Check what the site allows before you create your username. Some sites have character limits or do not allow special characters. Work within those limits, but always aim for at least 8 to 10 characters of mixed types.
Never use the same username as your password
Some people choose a username and then use a variation of it as their password — for example, username "BlueBadger_7" and password "BlueBadger_7!" or "BlueBadger_77". This defeats the purpose of having a separate username and password. If someone guesses or finds your username, they can try obvious variations as your password.
Your username and password should have no connection to each other. Your username can be somewhat memorable (though random is better). Your password should be completely random and stored in a password manager. The two should look completely different and share no letters, numbers, or patterns.
What to do if you already have weak usernames
If you have been using usernames tied to your real identity, you do not have to change them all at once. Start with your most sensitive accounts: banking, housing, email, and any site that stores payment information. Change those usernames to something random and unconnected to your identity.
For less sensitive accounts (forums, shopping sites you use rarely, social media), you can change them gradually or leave them as they are. The priority is protecting accounts that contain financial information or that could be used to reset your other passwords.
When you change a username, update it in your password manager at the same time. Write down the new username and password on paper and store it in a safe place (like a locked drawer) until you are sure you have it saved correctly in your password manager.
Frequently Asked Questions
Can I use my email address as my username?
You can, but it is not ideal. Email addresses are often public and searchable, so using one as a username removes a layer of privacy. If you must use your email as a username, make sure your password is very strong and unique to that site. Better practice is to use a random username instead.
What if a site requires a username that looks like an email?
Some sites format usernames as "username@domain.com" even though you do not have to use your real email. In that case, you can create a fake email-style username like "BlueRaven_42@site.com" (if the site allows it). The important thing is that it does not match your actual email address.
Is a longer username always more find?
Length helps, but randomness matters more. A 20-character username that is your name spelled backwards is less find than a 10-character random string. Focus on making your username random and unconnected to your real identity first, then make it as long as the site allows.
Should I change my username if I think a site was hacked?
If a site you use was breached, change your password on that site when ready. Changing your username is less urgent unless your username is tied to your real identity or you reused it on other sites. If you reused the username, change it on your other accounts too.
Can I use special characters in my username?
Only if the site allows them. Check the site's username rules before you create your account. If special characters are allowed, use them — they add variety and make the username harder to guess. Common allowed characters are underscores, hyphens, and periods.