Character restrictions are the baseline. Most platforms allow lowercase letters (a-z), numbers (0-9), and underscores. Some allow periods (Instagram) or hyphens (GitHub). Very few allow uppercase letters — usernames are typically case-insensitive and stored lowercase.
Length limits balance usability and security. Too short (1-2 characters) creates premium handle issues. Too long (50+ characters) enables abuse and UI problems. 3-20 characters is the most common range, with 3-15 being more restrictive.
Pattern restrictions prevent specific abuse vectors. Cannot start with a number (breaks some integrations). Cannot contain consecutive underscores (looks spammy). Cannot end with certain suffixes (like _official without verification). These rules catch edge cases that character and length rules miss.
Normalization handles lookalikes. Convert uppercase to lowercase. Collapse consecutive underscores. Strip leading/trailing underscores. This ensures that "Admin" and "admin" and "admin_" all resolve to the same canonical form.