tooldura

Stack those rules on top of each other and the intersection is small: lowercase letters, digits, and fifteen characters. A handle inside that budget can be registered anywhere in the table without a single edit.

That is the practical reason to design a username against the strictest platform rather than the one you are signing up for today. Fifteen characters, the cap X and Snapchat share, is the binding constraint, and it is not generous: two ordinary English words average around eleven characters together, so word pairs fit while phrases do not.

Digits are safe everywhere, but a leading digit is a bad idea for a reason that has nothing to do with the rules. It reads as a typo in a mention, it sorts oddly in any list of members, and a handful of older sign-up forms still refuse it outright. Put numbers at the end if you want them at all.

Each platform picked its own punctuation set years ago and has kept it. GitHub allows the hyphen and nothing else, because usernames become part of a URL path and, for Pages sites, part of a subdomain, where the hyphen is the only word separator a hostname permits. X allows the underscore and nothing else. Instagram and TikTok allow both the dot and the underscore.

So a handle written maya.reeves is unregistrable on X, Reddit, Twitch and GitHub, and maya-reeves is unregistrable on X, Instagram, Twitch, TikTok and Discord. The version with no separator at all, mayareeves, works on every one of them.

There is a second cost to a separator, and it shows up after you register. Impersonation accounts are usually built by adding or moving punctuation: an account already reading as two words leaves an obvious gap for a copy with an extra underscore. A name with no separator gives that trick less to work with, though nothing removes it entirely.

There is a measured answer to how identifying a username is. In a 2011 paper presented at the Privacy Enhancing Technologies Symposium, Perito, Castelluccia, Kaafar and Manils analysed roughly ten million usernames gathered from public profiles and estimated that an average username carries about 32 bits of entropy. That is enough to single out one person on a planet of eight billion, which is why an unusual handle is effectively a name.

The same work went further. It built a model that links accounts across services even when the usernames are not identical, because people modify their handle in predictable ways: adding a digit, swapping an underscore for a dot, truncating to fit a shorter limit. The variants a person invents for themselves are exactly the variants the model expects.

None of this argues for anonymity by default. For a professional identity, one recognisable handle across GitHub, LinkedIn and a personal site is the point: it makes you findable, which is what you want. It argues for deciding deliberately, and for not carrying a pseudonymous handle from a hobby forum onto an account that carries your legal name.

Single common words went years ago, and so did most two-word pairs on the largest platforms. X alone has issued hundreds of millions of handles since 2006, and the ones abandoned along the way stay locked to dormant accounts rather than returning to the pool. Platforms do run inactivity sweeps occasionally, but they are rare, announced in advance, and never a plan you can rely on.

This is what pushes people towards three tactics, in rough order of how well they hold up. Adding a digit is the weakest: it produces the exact variant an impersonator would also register, and it reads as a second choice. Adding a short prefix or suffix word works better, since real_ or _hq changes how the name reads rather than just padding it. Inventing a word outright is the only approach that reliably finds free names on every platform at once, and it is the reason brands do it.

Whichever you use, check the sign-up form rather than a lookup site. Availability changes by the minute, reserved words and trademark holds are not published anywhere, and the only authority on whether a name is free is the platform that would issue it.