Many websites when ask you to create a new "username", will limit you in some way, most often like "username should only contain letters and underscores" or something alike.

This results in inability to use my email as username and forces me to come up with new unique string all the time.

What is the rationale behind this?
Why not just let users use their emails, as a simple to remember and always unique?
What is generally wrong with having symbols like *&%$#@ as a part of username?

  • possible duplicate of Registration: Username and password or email and password
    – rk.
    Commented Apr 24, 2013 at 12:40
  • 1
    @rk. That question's definitely related, but I don't think they're duplicates. This one asks why users aren't allowed to use emails (and other odd strings) if they want to, while that one asks about the costs and benefits of defaulting to use emails as usernames. Commented Apr 24, 2013 at 14:08

2 Answers 2


There are many valid reasons to limit username format.

  1. Uniqueness. If you allow multiple character sets, you can end up with names that look exactly the same, but are technically different. For example, many Cyrillic script characters look exactly the same as Latin characters but are in fact different. "Нarry" and "Harry" aren't the same word, even though they look the same. The "Н" in the first on is Cyrillic, and in the second one it is Latin.

  2. Abuse. It's common to restrict words or phrases that could be considered abusive or offensive to most users. This may include swearing and hate speech.

  3. Readability. If you don't have some sane rules, you may end up with names like "73d37sl29", or "zzzzzzzzzzzzz" which aren't easy to refer to, or compare to other names which could be "73d37s129" or "zzzzzzzzzzzzzz" (note that they slightly different).

  4. Security. You need to prevent the username from itself including code which could compromise the system. The easiest way to do this is to exclude characters that have special meaning in programming languages. Most special characters (e.g. !@#$%^&*()~`;:) have some meaning already, so it's safest to avoid all of them. enter image description here

  • 2
    as for the pic - SQL injections are not working with modern ORMs at all... I haven't seen hand crafted SQLs built using strings concatenation for a long time... Commented Apr 24, 2013 at 13:47
  • 1
    I like your points, even most of them has nothing to do with disabling special chars Commented Apr 24, 2013 at 13:48
  • 2
    "Readability" - couldn't help but think of all those user123456 accounts on SE. :) Commented Apr 24, 2013 at 14:35
  • @IgorRomanov I thought that the "security" point covered special characters. Clearly not, so I will make it more explicit.
    – JohnGB
    Commented Apr 24, 2013 at 14:50
  • 1
    Even if 'special' characters have some meaning in programming languages, it's still a lazy option to just ban them from user input. That route leads to users not being able to enter their own name (e.g. O'Reilly), which is insulting. A better approach would be to allow punctuation characters, but escape them correctly in the code. Commented May 7, 2013 at 9:39

Creating a white-list of allowed characters is easier than creating a black-list of all characters that might cause problems, such as code injection due to poor handling of strings.

  • Yes, but just by allowing @ and . could make inventing of a new usernames so much easier for most users. Ask email and password, allow to set custom Display Name if that is needed. Commented May 13, 2014 at 15:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.