Username Validation Regex: Alphanumeric Pattern

Learn how to validate usernames with the regex pattern ^[a-z0-9_-]{3,16}$ for alphanumeric usernames with underscores and hyphens.

Pattern Breakdown

^[a-z0-9_-]{3,16}$

Components

Character Classes

• a-z - Lowercase letters (a through z)
• 0-9 - All digits (0 through 9)
• _ - Underscore character
• - - Hyphen character (placed at end to avoid range interpretation)
• {3,16} - Quantifier: between 3 and 16 occurrences (inclusive)

Examples

Valid:

• john_doe
• user123
• admin-user
• test_123
• abc
• verylongusername123

Invalid:

• ab (too short, minimum 3 characters)
• this_username_is_too_long (too long, maximum 16 characters)
• JohnDoe (uppercase letters not allowed)
• user name (spaces not allowed)
• user@name (special characters not allowed except _ and -)
• user.name (dots not allowed)

Implementation

JavaScript

const usernameRegex = /^[a-z0-9_-]{3,16}$/;
usernameRegex.test('john_doe'); // true
usernameRegex.test('user123'); // true
usernameRegex.test('ab'); // false (too short)
usernameRegex.test('this_username_is_too_long'); // false (too long)

Python

import re
username_regex = r'^[a-z0-9_-]{3,16}$'
bool(re.match(username_regex, 'john_doe'))  # True
bool(re.match(username_regex, 'user123'))  # True
bool(re.match(username_regex, 'ab'))  # False (too short)

Go

usernameRegex := regexp.MustCompile(`^[a-z0-9_-]{3,16}$`)
usernameRegex.MatchString("john_doe") // true
usernameRegex.MatchString("user123") // true
usernameRegex.MatchString("ab") // false (too short)

Limitations

1. Case sensitivity: Only allows lowercase letters (use [a-zA-Z0-9_-] for case-insensitive)
2. No Unicode support: Doesn't support international characters
3. Fixed length: Hard-coded 3-16 character limit
4. No reserved words check: Doesn't prevent reserved usernames like admin, root
5. No consecutive special chars: Allows user__name and user--name which might be undesirable

When to Use

• Simple username validation for web applications
• When you want lowercase-only usernames
• Quick client-side validation
• Basic authentication systems

For production, consider:

• Case-insensitive matching: ^[a-zA-Z0-9_-]{3,16}$
• Checking against reserved username lists
• Preventing consecutive special characters
• Adding server-side validation