diff --git a/docs/index.rst b/docs/index.rst
index 3d2a5de..2c2d480 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -46,7 +46,9 @@ Then, you must create the configuration file for JupyterHub:
 
 And change the default Authenticator class for our Native Authenticator class:
 
-`c.JupyterHub.authenticator_class = 'nativeauthenticator.NativeAuthenticator'`
+.. code-block:: python
+
+    c.JupyterHub.authenticator_class = 'nativeauthenticator.NativeAuthenticator'
 
 
 Run your JupyterHub normally, and the authenticator will be running with it.
@@ -66,10 +68,16 @@ If you are and admin, be sure that your username is listed on the `admin_users`
 If you create a new user that is listed as an admin on the config file, it will automatically have access to the system just after the signup. 
 
 
+Usernames restrictions
+----------------------
+
+Usernames can't contain commas, whitespaces, slashes or be empty. If any of these are in the username on signup, the user won't be able to do the signup. 
+
+
 Authorize new users
 -------------------
 
-To authorize new users to enter the system or to manage those that already have access to the system you can go to `<ip:port>/hub/authorize`. 
+To authorize new users to enter the system or to manage those that already have access to the system you can go to `/hub/authorize`. 
 
 
 Change password
diff --git a/nativeauthenticator/handlers.py b/nativeauthenticator/handlers.py
index 49325e8..9798b31 100644
--- a/nativeauthenticator/handlers.py
+++ b/nativeauthenticator/handlers.py
@@ -43,9 +43,17 @@ class SignUpHandler(LocalBase):
                        'home page and log in the system')
         if not user:
             alert = 'alert-danger'
-            message = ('Something went wrong. Be sure your password has at '
-                       f'least {self.authenticator.minimum_password_length} '
-                       'characters and is not too common.')
+            pw_len = self.authenticator.minimum_password_length
+
+            if pw_len:
+                message = ("Something went wrong. Be sure your password has "
+                           f"at least {pw_len} characters, doesn't have "
+                           "spaces or commas and is not too common.")
+            else:
+                message = ("Something went wrong. Be sure your password "
+                           " doesn't have spaces or commas and is not too "
+                           "common.")
+
         return alert, message
 
     async def post(self):
diff --git a/nativeauthenticator/nativeauthenticator.py b/nativeauthenticator/nativeauthenticator.py
index 6c8b934..3cf27b9 100644
--- a/nativeauthenticator/nativeauthenticator.py
+++ b/nativeauthenticator/nativeauthenticator.py
@@ -133,7 +133,8 @@ class NativeAuthenticator(Authenticator):
         if user:
             return user
 
-        if not self.is_password_strong(pw):
+        if not self.is_password_strong(pw) or \
+           not self.validate_username(username):
             return
 
         encoded_pw = bcrypt.hashpw(pw.encode(), bcrypt.gensalt())
@@ -150,6 +151,12 @@ class NativeAuthenticator(Authenticator):
         user.password = bcrypt.hashpw(new_password.encode(), bcrypt.gensalt())
         self.db.commit()
 
+    def validate_username(self, username):
+        invalid_chars = [',', ' ']
+        if any((char in username) for char in invalid_chars):
+            return False
+        return super().validate_username(username)
+
     def get_handlers(self, app):
         native_handlers = [
             (r'/signup', SignUpHandler),

Add username sanitization
diff --git a/nativeauthenticator/tests/test_authenticator.py b/nativeauthenticator/tests/test_authenticator.py
index 67aeb39..c5f55ce 100644
--- a/nativeauthenticator/tests/test_authenticator.py
+++ b/nativeauthenticator/tests/test_authenticator.py
@@ -45,6 +45,13 @@ async def test_create_user(is_admin, open_signup, expected_authorization,
     assert user.is_authorized == expected_authorization
 
 
+async def test_create_user_bas_characters(tmpcwd, app):
+    '''Test method get_or_create_user with bad characters on username'''
+    auth = NativeAuthenticator(db=app.db)
+    assert not auth.get_or_create_user('john snow', 'password')
+    assert not auth.get_or_create_user('john,snow', 'password')
+
+
 @pytest.mark.parametrize("password,min_len,expected", [
     ("qwerty", 1, False),
     ("agameofthrones", 1, True),
@@ -57,24 +64,24 @@ async def test_create_user_with_strong_passwords(password, min_len, expected,
     auth = NativeAuthenticator(db=app.db)
     auth.check_common_password = True
     auth.minimum_password_length = min_len
-    user = auth.get_or_create_user('John Snow', password)
+    user = auth.get_or_create_user('johnsnow', password)
     assert bool(user) == expected
 
 
 @pytest.mark.parametrize("username,password,authorized,expected", [
     ("name", '123', False, False),
-    ("John Snow", '123', True, False),
+    ("johnsnow", '123', True, False),
     ("Snow", 'password', True, False),
-    ("John Snow", 'password', False, False),
-    ("John Snow", 'password', True, True),
+    ("johnsnow", 'password', False, False),
+    ("johnsnow", 'password', True, True),
 ])
 async def test_authentication(username, password, authorized, expected,
                               tmpcwd, app):
     '''Test if authentication fails with a unexistent user'''
     auth = NativeAuthenticator(db=app.db)
-    auth.get_or_create_user('John Snow', 'password')
+    auth.get_or_create_user('johnsnow', 'password')
     if authorized:
-        UserInfo.change_authorization(app.db, 'John Snow')
+        UserInfo.change_authorization(app.db, 'johnsnow')
     response = await auth.authenticate(app, {'username': username,
                                              'password': password})
     assert bool(response) == expected
@@ -123,9 +130,9 @@ async def test_authentication_with_exceed_atempts_of_login(tmpcwd, app):
     auth.allowed_failed_logins = 3
     auth.secs_before_next_try = 10
 
-    infos = {'username': 'John Snow', 'password': 'wrongpassword'}
+    infos = {'username': 'johnsnow', 'password': 'wrongpassword'}
     auth.get_or_create_user(infos['username'], 'password')
-    UserInfo.change_authorization(app.db, 'John Snow')
+    UserInfo.change_authorization(app.db, 'johnsnow')
 
     for i in range(3):
         response = await auth.authenticate(app, infos)

pip install -e .
parse_log_pytest
requirements.txt
pytest pytest-asyncio
apt-get update apt-get install -y gcc
3.7
dev-requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
alembic==1.12.1
async-generator==1.10
attrs==24.2.0
backcall==0.2.0
bcrypt==4.2.1
beautifulsoup4==4.13.3
bleach==6.0.0
certifi @ file:///croot/certifi_1671487769961/work/certifi
certipy==0.2.2
cffi==1.15.1
charset-normalizer==3.4.1
codecov==2.1.13
coverage==7.2.7
cryptography==44.0.2
debugpy==1.7.0
decorator==5.1.1
defusedxml==0.7.1
entrypoints==0.4
exceptiongroup==1.2.2
fastjsonschema==2.21.1
flake8==5.0.4
greenlet==3.1.1
idna==3.10
importlib-metadata==4.2.0
importlib-resources==5.12.0
iniconfig==2.0.0
ipykernel==6.16.2
ipython==7.34.0
ipython-genutils==0.2.0
jedi==0.19.2
Jinja2==3.1.6
jsonschema==4.17.3
jupyter-telemetry==0.1.0
jupyter_client==7.4.9
jupyter_core==4.12.0
jupyterhub==4.1.6
-e git+https://github.com/jupyterhub/nativeauthenticator.git@92b1193d5084e67b1bc263fc59650cdec1e03538#egg=jupyterhub_nativeauthenticator
jupyterlab-pygments==0.2.2
Mako==1.2.4
MarkupSafe==2.1.5
matplotlib-inline==0.1.6
mccabe==0.7.0
mistune==3.0.2
nbclient==0.7.4
nbconvert==7.6.0
nbformat==5.8.0
nest-asyncio==1.6.0
notebook==5.7.2
oauthlib==3.2.2
packaging==24.0
pamela==1.2.0
pandocfilters==1.5.1
parso==0.8.4
pexpect==4.9.0
pickleshare==0.7.5
pkgutil_resolve_name==1.3.10
pluggy==1.2.0
prometheus-client==0.17.1
prompt_toolkit==3.0.48
psutil==7.0.0
ptyprocess==0.7.0
pycodestyle==2.9.1
pycparser==2.21
pyflakes==2.5.0
Pygments==2.17.2
pyrsistent==0.19.3
pytest==7.4.4
pytest-asyncio==0.21.2
python-dateutil==2.9.0.post0
python-json-logger==3.0.1
pyzmq==26.2.1
requests==2.31.0
ruamel.yaml==0.18.10
ruamel.yaml.clib==0.2.8
Send2Trash==1.8.3
six==1.17.0
soupsieve==2.4.1
SQLAlchemy==2.0.40
terminado==0.17.1
tinycss2==1.2.1
tomli==2.0.1
tornado==6.2
traitlets==5.9.0
typing_extensions==4.7.1
urllib3==2.0.7
wcwidth==0.2.13
webencodings==0.5.1
zipp==3.15.0

name: nativeauthenticator
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - certifi=2022.12.7=py37h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=1.1.1w=h7f8727e_0
  - pip=22.3.1=py37h06a4308_0
  - python=3.7.16=h7a1cb2a_0
  - readline=8.2=h5eee18b_0
  - setuptools=65.6.3=py37h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - wheel=0.38.4=py37h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - alembic==1.12.1
      - async-generator==1.10
      - attrs==24.2.0
      - backcall==0.2.0
      - bcrypt==4.2.1
      - beautifulsoup4==4.13.3
      - bleach==6.0.0
      - certipy==0.2.2
      - cffi==1.15.1
      - charset-normalizer==3.4.1
      - codecov==2.1.13
      - coverage==7.2.7
      - cryptography==44.0.2
      - debugpy==1.7.0
      - decorator==5.1.1
      - defusedxml==0.7.1
      - entrypoints==0.4
      - exceptiongroup==1.2.2
      - fastjsonschema==2.21.1
      - flake8==5.0.4
      - greenlet==3.1.1
      - idna==3.10
      - importlib-metadata==4.2.0
      - importlib-resources==5.12.0
      - iniconfig==2.0.0
      - ipykernel==6.16.2
      - ipython==7.34.0
      - ipython-genutils==0.2.0
      - jedi==0.19.2
      - jinja2==3.1.6
      - jsonschema==4.17.3
      - jupyter-client==7.4.9
      - jupyter-core==4.12.0
      - jupyter-telemetry==0.1.0
      - jupyterhub==4.1.6
      - jupyterlab-pygments==0.2.2
      - mako==1.2.4
      - markupsafe==2.1.5
      - matplotlib-inline==0.1.6
      - mccabe==0.7.0
      - mistune==3.0.2
      - nbclient==0.7.4
      - nbconvert==7.6.0
      - nbformat==5.8.0
      - nest-asyncio==1.6.0
      - notebook==5.7.2
      - oauthlib==3.2.2
      - packaging==24.0
      - pamela==1.2.0
      - pandocfilters==1.5.1
      - parso==0.8.4
      - pexpect==4.9.0
      - pickleshare==0.7.5
      - pkgutil-resolve-name==1.3.10
      - pluggy==1.2.0
      - prometheus-client==0.17.1
      - prompt-toolkit==3.0.48
      - psutil==7.0.0
      - ptyprocess==0.7.0
      - pycodestyle==2.9.1
      - pycparser==2.21
      - pyflakes==2.5.0
      - pygments==2.17.2
      - pyrsistent==0.19.3
      - pytest==7.4.4
      - pytest-asyncio==0.21.2
      - python-dateutil==2.9.0.post0
      - python-json-logger==3.0.1
      - pyzmq==26.2.1
      - requests==2.31.0
      - ruamel-yaml==0.18.10
      - ruamel-yaml-clib==0.2.8
      - send2trash==1.8.3
      - six==1.17.0
      - soupsieve==2.4.1
      - sqlalchemy==2.0.40
      - terminado==0.17.1
      - tinycss2==1.2.1
      - tomli==2.0.1
      - tornado==6.2
      - traitlets==5.9.0
      - typing-extensions==4.7.1
      - urllib3==2.0.7
      - wcwidth==0.2.13
      - webencodings==0.5.1
      - zipp==3.15.0
prefix: /opt/conda/envs/nativeauthenticator

nativeauthenticator/tests/test_authenticator.py::test_create_user_bas_characters
nativeauthenticator/tests/test_authenticator.py::test_create_user[False-False-False] nativeauthenticator/tests/test_authenticator.py::test_create_user[True-False-True] nativeauthenticator/tests/test_authenticator.py::test_create_user[False-True-True] nativeauthenticator/tests/test_authenticator.py::test_create_user_with_strong_passwords[qwerty-1-False] nativeauthenticator/tests/test_authenticator.py::test_create_user_with_strong_passwords[agameofthrones-1-True] nativeauthenticator/tests/test_authenticator.py::test_create_user_with_strong_passwords[agameofthrones-15-False] nativeauthenticator/tests/test_authenticator.py::test_create_user_with_strong_passwords[averyveryverylongpassword-15-True] nativeauthenticator/tests/test_authenticator.py::test_authentication[name-123-False-False] nativeauthenticator/tests/test_authenticator.py::test_authentication[johnsnow-123-True-False] nativeauthenticator/tests/test_authenticator.py::test_authentication[Snow-password-True-False] nativeauthenticator/tests/test_authenticator.py::test_authentication[johnsnow-password-False-False] nativeauthenticator/tests/test_authenticator.py::test_authentication[johnsnow-password-True-True] nativeauthenticator/tests/test_authenticator.py::test_handlers nativeauthenticator/tests/test_authenticator.py::test_add_new_attempt_of_login nativeauthenticator/tests/test_authenticator.py::test_authentication_login_count nativeauthenticator/tests/test_authenticator.py::test_authentication_with_exceed_atempts_of_login nativeauthenticator/tests/test_authenticator.py::test_change_password
docs/index.rst nativeauthenticator/handlers.py nativeauthenticator/nativeauthenticator.py
docs/index.rst nativeauthenticator/handlers.py nativeauthenticator/nativeauthenticator.py