I have looked all over online as well as this site to try to find out more information regarding the security of this, but haven't found anything. In my particular case, the product is a website, but I think this question applies for any software that hosts a large number of users.

I know there are numerous websites out there that allow you to change your username, but at the same time there are many that do not allow it. I'm sure some that do not allow it may be just for simplicity, but possibly for security as well.

My question is just like the title asks:

**From a security standpoint, would you say it is good or bad practice to allow individuals to change their username?**

I currently cannot think of any reason not to allow it, given it is done properly (ie make it impossible for no duplicate usernames, require inputting current password to make sure password requirements are still met regarding not containing username, etc), but I can't help but think there's something I'm missing.

I know there are advantages from the user's perspective to allow them to change their username. An example would be if they set their username to their email address and decide to use a different email address later. I'm curious instead on the benefits vs risks regarding the security of the application and login process if you allow them to change their username.

Thanks for your time