No more writing shitty regexes to police usernames

Details

External ID

46376944

Source

HN

Company

—

Product

No more writing shitty regexes to police usernames

Website domain

username.dev

Launched

Dec. 24, 2025

Cohort

—

Upvotes

19

Upvotes percentile

0.6412213740458015

Tags

—

Fetched at

Sept. 7, 2026, 9:25 p.m.

Updated at

Sept. 7, 2026, 9:25 p.m.

Description

Every product that allows usernames eventually ships the same broken solution. Someone adds a blacklist. Then a regex. Then another regex copied from StackOverflow. It works just long enough to ship, and then `admin`, `support`, city names, brand impersonation, and obvious slurs start leaking through anyway. Everyone knows it’s fragile, but it gets ignored because "it’s just usernames".I’ve had to rebuild this logic across multiple products, and I got tired of pretending it’s a solved problem. So I built *username.dev*, an API that answers a more useful question than "is this taken?" — it tells you what a username actually represents.Instead of returning a boolean, the API classifies usernames into real categories like brands, public figures, places, system-reserved terms, dictionary words, premium handles, and offensive content, and returns structured metadata you can actually make decisions with. That means blocking impersonation without breaking legitimate users, stopping abuse without maintaining massive regex lists, and even monetizing high-demand usernames if that’s part of your product.Under the hood it’s intentionally boring infrastructure: Cloudflare Workers at the edge, KV for fast reads, D1 for usage and analytics, and a simple HTTP endpoint (`GET /check?input=foo`). P95 latency sits around 300ms globally. There’s no ML magic, no black box, and no attempt to be clever — just fast, deterministic classification.Pricing is usage-based and prepaid because subscriptions for infrastructure like this are annoying. There’s a free tier with 1,000 requests and no credit card. Use it, throw it away, or rip the idea off.If you think regex blacklists are "good enough", usernames don’t matter, or this is a trivial problem, you’re probably already shipping bugs — they’re just not loud enough yet.Tell me why this is a bad idea, what edge cases I’m missing, or what you’ve duct-taped together instead.— Sourabh

• Source listing
• Website