Pattern

Regex for GitHub username

GitHub username — alphanumeric + single hyphen, no leading/trailing hyphen.

The GitHub username regex is ^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$ — copy it below, or open it in the explainer for a token-by-token breakdown.

The pattern

^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$

Try in explainer → Download cheat sheet ↓

What it matches

octocat
dependabot[bot]
my-handle
user2024

What it doesn't match

-leading
trailing-
double--hyphen

Notes & gotchas

GitHub usernames: 1-39 chars, alphanumeric, single hyphens allowed but not consecutively, not at start/end. Note: dependabot[bot] is a special bot account — usually doesn't match without brackets.

Code in your language

Use the explainer's Code tab to generate ready-to-paste snippets in JavaScript, Python, Java, .NET, Go, Ruby, and PHP for this pattern.

Open in explainer →

Token-by-token breakdown

Every part of the pattern, left to right:

Token	Meaning
`^`	start of string (or line in multiline mode)
`[A-Za-z0-9]`	any of: uppercase letters, lowercase letters, digits
`(?:`	start of a non-capturing group
`[A-Za-z0-9]`	any of: uppercase letters, lowercase letters, digits
`\|`	OR — try the alternative
`-`	literal text “-”
`(?=`	start of a positive lookahead — followed by
`[A-Za-z0-9]`	any of: uppercase letters, lowercase letters, digits
`)`	end of group
`){0,38}`	end of group, between 0 and 38 times
`$`	end of string (or line in multiline mode)

About this pattern

Identifying and validating user identity (names, contact info, IDs) is one of the most common reasons developers reach for regex. The pattern below handles the format check; for full validation always confirm against a source of truth (database, API, or document).

Quick usage in different languages

This exact pattern — with the correct escaping and idioms for each language:

JavaScript: /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/.test(value)
Python: re.match(r"^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$", value)
Java: Pattern.compile("^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$").matcher(value).matches()
C# / .NET: Regex.IsMatch(value, @"^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$")
Go: regexp.MustCompile(`^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$`).MatchString(value)
Ruby: /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/.match?(value)
PHP: preg_match('~^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$~', $value)

The explainer’s Code tab regenerates these for any pattern you paste, and the downloadable cheat sheet bundles the breakdown, all seven snippets, and the pitfalls below onto one printable page.

Common pitfalls

Anchored to the whole string. This pattern uses ^ and $, so it requires the entire input to match. To find it inside a longer text, drop the anchors and use the global (g) flag.
ASCII letters only. [a-zA-Z] excludes accented and non-Latin letters (é, ü, ß, ñ, and non-Latin scripts). For international input use Unicode properties like \p{L} with the u flag.
Validate beyond format. Matching the format doesn't guarantee the value is real. Confirm the github username against a source of truth (database, API, or checksum) where it matters.

Related patterns

More patterns in the Identity & contact category: