diff --git a/changelog/unreleased/issue-131 b/changelog/unreleased/issue-131
index 2c7877c..fffe7f8 100644
--- a/changelog/unreleased/issue-131
+++ b/changelog/unreleased/issue-131
@@ -13,4 +13,5 @@ curl -v  -X DELETE -u foo/config:attack  http://localhost:8000/foo/config
 
 https://github.com/restic/rest-server/issues/131
 https://github.com/restic/rest-server/pull/132
+https://github.com/restic/rest-server/pull/137
 
diff --git a/htpasswd.go b/htpasswd.go
index d319e05..c009c99 100644
--- a/htpasswd.go
+++ b/htpasswd.go
@@ -100,7 +100,7 @@ func (h *HtpasswdFile) throttleTimer() {
 	}
 }
 
-var validUsernameRegexp = regexp.MustCompile(`^[\p{L}@.-]+$`)
+var validUsernameRegexp = regexp.MustCompile(`^[\p{L}\d@.-]+$`)
 
 // Reload reloads the htpasswd file. If the reload fails, the Users map is not changed and the error is returned.
 func (h *HtpasswdFile) Reload() error {