User Experience Stack Exchange is a question and answer site for user experience researchers and experts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Many websites when ask you to create a new "username", will limit you in some way, most often like "username should only contain letters and underscores" or something alike.

This results in inability to use my email as username and forces me to come up with new unique string all the time.

What is the rationale behind this?
Why not just let users use their emails, as a simple to remember and always unique?
What is generally wrong with having symbols like *&%$#@ as a part of username?

share|improve this question
possible duplicate of Registration: Username and password or email and password – rk. Apr 24 '13 at 12:40
@rk. That question's definitely related, but I don't think they're duplicates. This one asks why users aren't allowed to use emails (and other odd strings) if they want to, while that one asks about the costs and benefits of defaulting to use emails as usernames. – Graham Herrli Apr 24 '13 at 14:08

There are many valid reasons to limit username format.

  1. Uniqueness. If you allow multiple character sets, you can end up with names that look exactly the same, but are technically different. For example, many Cyrillic script characters look exactly the same as Latin characters but are in fact different. "Нarry" and "Harry" aren't the same word, even though they look the same. The "Н" in the first on is Cyrillic, and in the second one it is Latin.

  2. Abuse. It's common to restrict words or phrases that could be considered abusive or offensive to most users. This may include swearing and hate speech.

  3. Readability. If you don't have some sane rules, you may end up with names like "73d37sl29", or "zzzzzzzzzzzzz" which aren't easy to refer to, or compare to other names which could be "73d37s129" or "zzzzzzzzzzzzzz" (note that they slightly different).

  4. Security. You need to prevent the username from itself including code which could compromise the system. The easiest way to do this is to exclude characters that have special meaning in programming languages. Most special characters (e.g. !@#$%^&*()~`;:) have some meaning already, so it's safest to avoid all of them. enter image description here

share|improve this answer
+1 for the lulz! – rk. Apr 24 '13 at 13:28
as for the pic - SQL injections are not working with modern ORMs at all... I haven't seen hand crafted SQLs built using strings concatenation for a long time... – Igor Romanov Apr 24 '13 at 13:47
I like your points, even most of them has nothing to do with disabling special chars – Igor Romanov Apr 24 '13 at 13:48
"Readability" - couldn't help but think of all those user123456 accounts on SE. :) – MetalMikester Apr 24 '13 at 14:35
@IgorRomanov I thought that the "security" point covered special characters. Clearly not, so I will make it more explicit. – JohnGB Apr 24 '13 at 14:50

Creating a white-list of allowed characters is easier than creating a black-list of all characters that might cause problems, such as code injection due to poor handling of strings.

share|improve this answer
Yes, but just by allowing @ and . could make inventing of a new usernames so much easier for most users. Ask email and password, allow to set custom Display Name if that is needed. – Igor Romanov May 13 '14 at 15:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.