Regex for Usernames

Read it left to right. Each piece below matches one part of the input:

• ^ Start of the string.
• (?=.{3,16}$) Lookahead: the whole username is 3 to 16 characters. It checks without consuming, so matching restarts at the beginning.
• [A-Za-z] The first character must be a letter, so handles never look like numbers or flags.
• [A-Za-z0-9]* Any letters and digits after it.
• (?:[._-][A-Za-z0-9]+)* Optional groups of one separator followed by letters or digits. Separators can never be doubled or come last.
• $ End of the string.

The whole input must match, from the first character to the last. Every row below is checked against the pattern by our automated test suite before each release.

Each rule lives in one place, so adjust the part you need:

Two rules belong in code, not in the regex: reserved names (admin, support, root, api, your brand) and uniqueness. Compare usernames case-insensitively, and if you allow Unicode, normalize with NFKC first so look-alike characters cannot impersonate another user.

Without it you would have to count characters across the separators, which regex is bad at. (?=.{3,16}$) checks the total length once, at the start, and consumes nothing: the rest of the pattern then only describes the shape.

Go's RE2 engine does not support lookaheads. In Go, drop the lookahead and check len(username) (or utf8.RuneCountInString) in code, which is clearer anyway.

The pattern is translated for each engine rather than pasted as is: named groups, anchors, escapes, shorthand classes and flags are adjusted so each snippet behaves as closely to the JavaScript version as its engine allows. Differences that remain (Go's RE2 has no lookarounds or backreferences, for example) are called out under each one. The Code tab in the tester above also exports Dart, and updates as you edit the pattern.

JavaScript and TypeScript

const regex = /^(?=.{3,16}$)[A-Za-z][A-Za-z0-9]*(?:[._-][A-Za-z0-9]+)*$/;

function isValid(value) {
  return regex.test(value);
}

console.log(isValid("jane_doe"));

Python

import re

pattern = re.compile(r"^(?=.{3,16}\Z)[A-Za-z][A-Za-z0-9]*(?:[._\-][A-Za-z0-9]+)*\Z")

def is_valid(value: str) -> bool:
    return pattern.search(value) is not None

print(is_valid("jane_doe"))

• JavaScript's . also refuses \r, \u2028 and \u2029; in Python it only refuses \n.
• JavaScript's $ only matches at the very end of the string. Python's $ also matches before a trailing newline, so the pattern uses \Z instead.

Go

package main

import (
	"fmt"
	"regexp"
)

func main() {
	re := regexp.MustCompile(`^(?=.{3,16}$)[A-Za-z][A-Za-z0-9]*(?:[._\-][A-Za-z0-9]+)*$`)
	fmt.Println(re.MatchString("jane_doe"))
}

Go's regexp package (RE2) does not support lookahead or lookbehind, so this pattern will not compile. Match more broadly and check the extra condition in Go code instead.

• JavaScript's . also refuses \r, \u2028 and \u2029; in Go it only refuses \n.

C#

using System;
using System.Text.RegularExpressions;

// The timeout stops a pathological input from hanging the thread (ReDoS).
var regex = new Regex(@"^(?=.{3,16}\z)[A-Za-z][A-Za-z0-9]*(?:[._\-][A-Za-z0-9]+)*\z", RegexOptions.None, TimeSpan.FromSeconds(1));
Console.WriteLine(regex.IsMatch("jane_doe"));

• JavaScript's . also refuses \r, \u2028 and \u2029; in .NET it only refuses \n.
• JavaScript's $ only matches at the very end of the string. .NET's $ also matches before a trailing newline, so the pattern uses \z instead.

PHP

<?php

$pattern = '/^(?=.{3,16}$)[A-Za-z][A-Za-z0-9]*(?:[._\-][A-Za-z0-9]+)*$/D';

function isValid(string $value, string $pattern): bool
{
    return preg_match($pattern, $value) === 1;
}

var_dump(isValid('jane_doe', $pattern));

• JavaScript's . also refuses \r, \u2028 and \u2029; in PHP (PCRE) it only refuses \n.
• The D modifier makes $ match only at the very end, like JavaScript (PCRE's $ also matches before a trailing newline).

• Regex for URL Slugs: Lowercase letters and digits separated by single hyphens, like regex-tester.
• Regex for Alphanumeric Characters: Letters A–Z and digits only, with a Unicode variant for every script.
• Regex for Strong Passwords: 12+ characters with lowercase, uppercase, a digit and a symbol, built from lookaheads.
• Regex for Email Validation: Practical email check: dotted local part, real domain labels and a letters-only top-level domain.

Browse all 25 patterns in the regex pattern library, or build your own in the regex tester.