Username Regular Expression – Free, Online, Private

The pattern

The first character is a letter. The rest are letters, digits, or underscores, and there must be at least two more characters and at most 31 more. The whole name is therefore 3 to 32 characters. ada matches. ab does not, because it is too short. 1ada does not, because it starts with a digit. A hyphen is not allowed. The sample's longer name matches if it stays inside the limit. Count it in the tester rather than by eye.

The source is ^[a-zA-Z][a-zA-Z0-9_]{2,31}$. The flags on this page are m. i means case-insensitive. m means ^ and $ match at line breaks, which is how the sample can show several candidates. g is not set. The tester finds non-overlapping matches, and without g a pattern with no anchor still reports the matches it walks. The box under the title is a tester with this pattern and the sample already filled in. Edit either one. Nothing you type is uploaded. The same tester, without a preset, is the regex tool.

How to read it

[a-zA-Z] is the first character, exactly one, with no quantifier. [a-zA-Z0-9_]{2,31} is the rest. The underscore is inside the class, so it is literal. A hyphen would be a range if you dropped it between characters, which is a reason it is absent. Anchors and the m flag test each line. There is no dot and no space. An empty string fails both the first class and the length.

What it will not do

The pattern is ASCII. A name in another script fails, which may be the wrong rule for your product. Length 32 is a common column width, not a moral limit. Email addresses are not usernames here. A dot fails. If you allow dots, add them to the second class and decide whether a trailing dot is legal. The pattern does not check a reserved-word list. admin matches. Reject reserved names after the match.

A match is not a parsed value. An email pattern does not send mail, a UUID pattern does not allocate an id, and a password pattern does not store a password. When the next step needs a real parser, use one: the URL constructor, a date library, a semver library, or the converters on this site. The expression is the part you can see.

JavaScript, Python, and Go

The JavaScript snippet uses the RegExp constructor so the source does not have to be escaped for a literal slash. The Python snippet uses a normal string with the same escapes JSON would emit, which keeps \d as a regex digit class. Go's snippet uses a raw string. If the pattern contains a lookahead, the Go snippet says so and does not call MustCompile, because RE2 would reject it at runtime.

JavaScriptconst re = new RegExp("^[a-zA-Z][a-zA-Z0-9_]{2,31}$", "m");
const found = text.match(re);
console.log(found ? found[0] : "no match");

Pythonimport re

pattern = re.compile("^[a-zA-Z][a-zA-Z0-9_]{2,31}$", re.MULTILINE)
found = pattern.search(text)
print(found.group(0) if found else "no match")

Gopackage main

import (
	"fmt"
	"regexp"
)

func main() {
	text := ""
	re := regexp.MustCompile(`(?m)^[a-zA-Z][a-zA-Z0-9_]{2,31}$`)
	fmt.Println(re.FindString(text))
}