diff --git a/open-isle-cli/src/components/TagSelect.vue b/open-isle-cli/src/components/TagSelect.vue
index ddc7aa04b..85cb36c50 100644
--- a/open-isle-cli/src/components/TagSelect.vue
+++ b/open-isle-cli/src/components/TagSelect.vue
@@ -1,9 +1,15 @@
 <template>
-  <Dropdown v-model="selected" :fetch-options="fetchTags" multiple placeholder="选择标签" />
+  <Dropdown
+    v-model="selected"
+    :fetch-options="fetchTags"
+    multiple
+    placeholder="选择标签"
+    remote
+  />
 </template>
 
 <script>
-import { computed } from 'vue'
+import { computed, ref } from 'vue'
 import { API_BASE_URL, toast } from '../main'
 import Dropdown from './Dropdown.vue'
 
@@ -11,15 +17,37 @@ export default {
   name: 'TagSelect',
   components: { Dropdown },
   props: {
-    modelValue: { type: Array, default: () => [] }
+    modelValue: { type: Array, default: () => [] },
+    creatable: { type: Boolean, default: false }
   },
   emits: ['update:modelValue'],
   setup(props, { emit }) {
-    const fetchTags = async () => {
+    const tags = ref([])
+
+    const loadTags = async () => {
+      if (tags.value.length) return
       const res = await fetch(`${API_BASE_URL}/api/tags`)
-      if (!res.ok) return []
+      if (!res.ok) return
       const data = await res.json()
-      return [{ id: 0, name: '无标签' }, ...data]
+      tags.value = [{ id: 0, name: '无标签' }, ...data]
+    }
+
+    const fetchTags = async (kw = '') => {
+      await loadTags()
+      let options = tags.value.filter(t =>
+        !kw || t.name.toLowerCase().includes(kw.toLowerCase())
+      )
+      if (
+        props.creatable &&
+        kw &&
+        !tags.value.some(t => t.name.toLowerCase() === kw.toLowerCase())
+      ) {
+        options = [
+          ...options,
+          { id: `__create__:${kw}`, name: `创建"${kw}"` }
+        ]
+      }
+      return options
     }
 
     const selected = computed({
@@ -34,6 +62,17 @@ export default {
             toast.error('最多选择两个标签')
             return
           }
+          v = v.map(id => {
+            if (typeof id === 'string' && id.startsWith('__create__:')) {
+              const name = id.slice(11)
+              const newId = `__new__:${name}`
+              if (!tags.value.find(t => t.id === newId)) {
+                tags.value.push({ id: newId, name })
+              }
+              return newId
+            }
+            return id
+          })
         }
         emit('update:modelValue', v)
       }
diff --git a/open-isle-cli/src/views/NewPostPageView.vue b/open-isle-cli/src/views/NewPostPageView.vue
index 787901fcb..5617454c4 100644
--- a/open-isle-cli/src/views/NewPostPageView.vue
+++ b/open-isle-cli/src/views/NewPostPageView.vue
@@ -8,7 +8,7 @@
       <div class="post-options">
         <div class="post-options-left">
           <CategorySelect v-model="selectedCategory" />
-          <TagSelect v-model="selectedTags" />
+          <TagSelect v-model="selectedTags" creatable />
         </div>
         <div class="post-options-right">
           <div class="post-clear" @click="clearPost">
@@ -120,6 +120,29 @@ export default {
         toast.error('保存失败')
       }
     }
+    const ensureTags = async (token) => {
+      for (let i = 0; i < selectedTags.value.length; i++) {
+        const t = selectedTags.value[i]
+        if (typeof t === 'string' && t.startsWith('__new__:')) {
+          const name = t.slice(8)
+          const res = await fetch(`${API_BASE_URL}/api/tags`, {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+              Authorization: `Bearer ${token}`
+            },
+            body: JSON.stringify({ name, description: '' })
+          })
+          if (res.ok) {
+            const data = await res.json()
+            selectedTags.value[i] = data.id
+            // update local TagSelect options handled by component
+          } else {
+            throw new Error('create tag failed')
+          }
+        }
+      }
+    }
     const submitPost = async () => {
       if (!title.value.trim()) {
         toast.error('标题不能为空')
@@ -139,6 +162,7 @@ export default {
       }
       try {
         const token = getToken()
+        await ensureTags(token)
         const res = await fetch(`${API_BASE_URL}/api/posts`, {
           method: 'POST',
           headers: {
diff --git a/src/main/java/com/openisle/config/SecurityConfig.java b/src/main/java/com/openisle/config/SecurityConfig.java
index e9fe79ad6..1ff65f91f 100644
--- a/src/main/java/com/openisle/config/SecurityConfig.java
+++ b/src/main/java/com/openisle/config/SecurityConfig.java
@@ -90,7 +90,7 @@ public class SecurityConfig {
                     .requestMatchers(HttpMethod.GET, "/api/search/**").permitAll()
                     .requestMatchers(HttpMethod.GET, "/api/users/**").permitAll()
                     .requestMatchers(HttpMethod.POST, "/api/categories/**").hasAuthority("ADMIN")
-                    .requestMatchers(HttpMethod.POST, "/api/tags/**").hasAuthority("ADMIN")
+                    .requestMatchers(HttpMethod.POST, "/api/tags/**").authenticated()
                     .requestMatchers(HttpMethod.DELETE, "/api/categories/**").hasAuthority("ADMIN")
                     .requestMatchers(HttpMethod.DELETE, "/api/tags/**").hasAuthority("ADMIN")
                     .requestMatchers("/api/admin/**").hasAuthority("ADMIN")
diff --git a/src/main/java/com/openisle/service/TagService.java b/src/main/java/com/openisle/service/TagService.java
index f81c5319f..48c015e32 100644
--- a/src/main/java/com/openisle/service/TagService.java
+++ b/src/main/java/com/openisle/service/TagService.java
@@ -11,8 +11,10 @@ import java.util.List;
 @RequiredArgsConstructor
 public class TagService {
     private final TagRepository tagRepository;
+    private final TagValidator tagValidator;
 
     public Tag createTag(String name, String description, String icon, String smallIcon) {
+        tagValidator.validate(name);
         Tag tag = new Tag();
         tag.setName(name);
         tag.setDescription(description);
@@ -25,6 +27,7 @@ public class TagService {
         Tag tag = tagRepository.findById(id)
                 .orElseThrow(() -> new IllegalArgumentException("Tag not found"));
         if (name != null) {
+            tagValidator.validate(name);
             tag.setName(name);
         }
         if (description != null) {
diff --git a/src/main/java/com/openisle/service/TagValidator.java b/src/main/java/com/openisle/service/TagValidator.java
new file mode 100644
index 000000000..4c650f044
--- /dev/null
+++ b/src/main/java/com/openisle/service/TagValidator.java
@@ -0,0 +1,20 @@
+package com.openisle.service;
+
+import com.openisle.exception.FieldException;
+import org.springframework.stereotype.Service;
+
+import java.util.regex.Pattern;
+
+@Service
+public class TagValidator {
+    private static final Pattern ALLOWED = Pattern.compile("^[A-Za-z0-9\\u4e00-\\u9fa5]+$");
+
+    public void validate(String name) {
+        if (name == null || name.isBlank()) {
+            throw new FieldException("name", "Tag name cannot be empty");
+        }
+        if (!ALLOWED.matcher(name).matches()) {
+            throw new FieldException("name", "Tag name must be letters or numbers");
+        }
+    }
+}