diff --git a/backend/src/models/User.js b/backend/src/models/User.js
index 72cef4093..4bab080ca 100644
--- a/backend/src/models/User.js
+++ b/backend/src/models/User.js
@@ -4,7 +4,7 @@ module.exports = {
   id: { type: 'string', primary: true, default: uuid }, // TODO: should be type: 'uuid' but simplified for our tests
   actorId: { type: 'string', allow: [null] },
   name: { type: 'string', disallow: [null], min: 3 },
-  slug: 'string',
+  slug: { type: 'string', regex: /^[a-z0-9_-]+$/, lowercase: true },
   encryptedPassword: 'string',
   avatar: { type: 'string', allow: [null] },
   coverImg: { type: 'string', allow: [null] },
diff --git a/backend/src/models/User.spec.js b/backend/src/models/User.spec.js
index e00136970..5c8067413 100644
--- a/backend/src/models/User.spec.js
+++ b/backend/src/models/User.spec.js
@@ -18,3 +18,44 @@ describe('role', () => {
     )
   })
 })
+
+describe('slug', () => {
+  it('normalizes to lowercase letters', async () => {
+    const user = await instance.create('User', { slug: 'Matt' })
+    await expect(user.toJson()).resolves.toEqual(
+      expect.objectContaining({
+        slug: 'matt',
+      }),
+    )
+  })
+
+  describe('characters', () => {
+    const createUser = attrs => {
+      return instance.create('User', attrs).then(user => user.toJson())
+    }
+
+    it('-', async () => {
+      await expect(createUser({ slug: 'matt-rider' })).resolves.toMatchObject({
+        slug: 'matt-rider',
+      })
+    })
+
+    it('_', async () => {
+      await expect(createUser({ slug: 'matt_rider' })).resolves.toMatchObject({
+        slug: 'matt_rider',
+      })
+    })
+
+    it(' ', async () => {
+      await expect(createUser({ slug: 'matt rider' })).rejects.toThrow(
+        /fails to match the required pattern/,
+      )
+    })
+
+    it('ä', async () => {
+      await expect(createUser({ slug: 'mätt' })).rejects.toThrow(
+        /fails to match the required pattern/,
+      )
+    })
+  })
+})