I need to reserve usernames in my new website.

These generally fall into three categories

1) usernames no-one should have (eg: admin, user, service, help, root, etc)

2) names of super famous people or companies we may want to reserve in the event that they show up

3) other names specified by us directly.

It would be really helpful if some list of usernames for the first 2 categories existed somewhere and I could just use them.

Does anyone know of such a list?

  • 19
    2 is pretty obnoxious. If my name is Sean Penn, and I happen to register first, I should get the account. Even if the name is trademarked, that doesn't block legitimate third-party uses. If my name isn't Sean Penn, you can confiscate the account. But that kind of identity verification probably can't be done completely automatically. Commented Mar 15, 2011 at 19:31
  • 2
    I appreciate your opinion but note that I also mentioned companies. I don't believe it is wrong to reserve starbucks@myapp for the actual starbucks company representative. Either way I'd love some suggestions on 1)
    – mattx
    Commented Mar 15, 2011 at 19:56
  • 4
    It's not quite what you asked for but RFC 2142 ietf.org/rfc/rfc2142.txt has reserved email addresses. If you use usernames for email, you might want to prevent these from being used.
    – Ken
    Commented Mar 15, 2011 at 20:11
  • 1
    I agree with others that fulfilling 2 would be really difficult. Matthew addressed the problem with same names. When it comes to the use of business names you could disclose in your "rules" that use of business names is not permitted unless you are such and such to that company. If in the case that someone does use a business name that isn't allowed build in procedures for a business to claim that name. There are so many business that come and go each day, it is all too subjective to say that Pepsi should be reserved and not Mell's Diner. Mell's may bring money to your site and not others. Commented Mar 19, 2011 at 11:12
  • 2
    The BEST way of doing this is to simply always deny the first (and perhaps even the second) user name that a user wants - claiming it is already taken. Store their requested user names, and then really use it as a reference for denying user names. Jokes aside, don't do that.
    – pellepim
    Commented Jun 17, 2011 at 15:13

3 Answers 3


Yes I have this list with more than 300 reserved usernames. I had to create the list because I am the webmaster of http://postbit.com/ (where users can choose any username as a subdomain (yourname.postbit.com) to create blog and photo albums. We created a list of reserved usernames and subdomains that can not be registered by others.

Here is our complete list of reserved names: http://blog.postbit.com/reserved-username-list.html

Before we had that list, one of the first users registered his username as "www", so he took our main domain and we had to remove his login and create this blacklist.

In the list there are default domain names (such as www, ftp, poop, smtp, ns..), some default unix usernames (root, webmaster, mysql, http, pop, postfix) and reserved words for internal use (devel, tests, scripts, support, search) and also reserved usernames for future use (mobile, downloads, music, games) and more.

  • 19
    "Before we had that list, one of the first users registered his username as "www", so he took our main domain" LOL. Oh the things that miss testing....
    – Eric G
    Commented Oct 20, 2011 at 20:44
  • Nice List Rodrigo! I put it in a Google doc here: docs.google.com/spreadsheet/… along with a few others in the begging of the list. I added three columns, one w/ quotes and one w/ quotes and a comma so the list can be easily pasted into your programming language of choice.
    – Jon Kragh
    Commented Nov 30, 2012 at 2:06
  • 2
    Nice! You might want to add administrator (see here; it is trusted by CAs and anyone who owns that email address can obtain a signed certificate for your domain) and abuse (see RFC 2142). (Cc: @JonKragh)
    – D.W.
    Commented Mar 19, 2015 at 20:36
  • 1
    The blog link is broken.
    – Goose
    Commented Nov 3, 2017 at 13:07
  • 4
    The blog link is broken. Fortunately, it is available through the Wayback Machine: web.archive.org/web/20191116001648/http://blog.postbit.com/…
    – hb20007
    Commented May 30, 2020 at 14:05

A good way to find those standard usernames is by using word-lists designed for brute-force attacks. They may contain too many simple names but a simple search using your favorite search engine for a combination of "brute-force", "dictionary" and "wordlist" may bring up what you need. E.g. :

There are many of those lists, but no standard list.

This link from the Internet Archive contains a gzip compressed text file of word-lists from 2013.


If you're hoping to end up being vary large and want to reserve celebrity names (which, I personally think is reasonable from a future marketing standpoint) I would consider grabbing the top few hundred twitter handles from http://twitaholic.com/