diff --git a/index.js b/index.js
index 0d0de6e..9547071 100644
--- a/index.js
+++ b/index.js
@@ -7,8 +7,8 @@ const REGEX_HTTP_PROTOCOL = /^https?:\/\//i
 
 module.exports = url => {
   try {
-    const { href, hostname, hash } = new URL(url)
-    if (!REGEX_HTTP_PROTOCOL.test(href)) return false
+    const { href, hostname, hash, username, password } = new URL(url)
+    if (!REGEX_HTTP_PROTOCOL.test(href) || username || password) return false
     const isIPv6 = hostname.startsWith('[') && hostname.endsWith(']')
     const isPunycode = punycodeRegex.test(hostname)
     const hasTextFragment = hash.startsWith('#:~:text=')
diff --git a/test/index.js b/test/index.js
index 0b2b0fd..9ffc16c 100644
--- a/test/index.js
+++ b/test/index.js
@@ -51,6 +51,10 @@ const test = require('ava').default
         'http://Http://xn--80a0aaa.xn--p1ai',
         'http://Http://kikobeats.com',
         'https://admin:admin@test-http-login.vercel.app',
+        'https://trusted.example@example.com/#:~:text=x',
+        'https://user:pass@example.com/#:~:text=Example',
+        'https://trusted.example@xn--80a0aaa.com/',
+        'http://user:pass@[::1]/',
         'http:!!!\0',
         'http://-kikobeats.com'
       ])