Username validation looks simple until requirements diverge across products. Some systems allow dots, some disallow trailing underscores, and others support full Unicode handles.

Baseline ASCII username (3-20 chars)

/^(?=.{3,20}$)(?!.*[_.-]{2})[a-z0-9]+(?:[_.-][a-z0-9]+)*$/i

Twitter/X style handle

/^@?[A-Za-z0-9_]{1,15}$/

Policy tips

• Reserve protected names (admin, support, root) outside regex.
• Normalize case for uniqueness checks.
• Use rate limits to prevent account-enumeration abuse.