Regex Password Validation — Strong Password Patterns
Password validation regex uses lookaheads to independently enforce each rule without caring about order. For example,(?=.*[A-Z]) asserts that at least one uppercase letter appears somewhere in the string — regardless of position.4 Password Validation Patterns
Minimum 8 characters
/.{8,}/Valid
password
12345678
abcd1234
Invalid
short
1234567
The most basic requirement — at least 8 characters of any type.
Uppercase + lowercase + digit (min 8)
/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$/Valid
Password1
Hello123
Abc12345
Invalid
password1
PASSWORD1
Password
Requires at least one lowercase letter, one uppercase letter, and one digit.
Strong: upper + lower + digit + special (min 8)
/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+\-=]).{8,}$/Valid
Password1!
Hello@123
Str0ng#Pass
Invalid
Password1
hello@123
HELLO@123
Enforces all four character classes: uppercase, lowercase, digit, special character.
Very strong (min 12, all classes)
/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+\-=]).{12,}$/Valid
VeryStr0ng!Pass
MyP@ssw0rd123
Invalid
Short1!
Password1!
Minimum 12 characters with all four character classes. Recommended for high-security systems.
Code Examples
JavaScript
// Strong password: 8+ chars, upper, lower, digit, special
const strongPassword = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+\-=]).{8,}$/;
function validatePassword(password) {
return {
valid: strongPassword.test(password),
minLength: password.length >= 8,
hasUppercase: /[A-Z]/.test(password),
hasLowercase: /[a-z]/.test(password),
hasDigit: /\d/.test(password),
hasSpecial: /[!@#$%^&*()_+\-=]/.test(password),
};
}
console.log(validatePassword("Hello@123"));
// { valid: true, minLength: true, hasUppercase: true, ... }Python
import re
def validate_password(password):
checks = {
"min_length": len(password) >= 8,
"has_uppercase": bool(re.search(r'[A-Z]', password)),
"has_lowercase": bool(re.search(r'[a-z]', password)),
"has_digit": bool(re.search(r'\d', password)),
"has_special": bool(re.search(r'[!@#$%^&*()_+\-=]', password)),
}
checks["valid"] = all(checks.values())
return checks
print(validate_password("Hello@123"))
# {'min_length': True, 'has_uppercase': True, ..., 'valid': True}Test Your Pattern Online
Related Guides
- → Regex Email Pattern
- → Regex URL Pattern
- → Regex Numbers Only Pattern
- → Common Regex Patterns
- → Regex Date Format
- → Regex Phone Number
Frequently Asked Questions
What makes a regex password validator strong?
Lookaheads ((?=...)) let you enforce multiple independent rules. Combine minimum length with character class requirements without caring about order.
Should I validate passwords with regex or a library?
For basic validation, regex works well. For advanced strength scoring (like zxcvbn), use a dedicated library.
What is a lookahead in regex?
A lookahead (?=...) asserts that a pattern matches ahead of the current position without consuming characters. (?=.*[A-Z]) means 'at least one uppercase letter exists somewhere.'
All tools run in your browser. Your data never leaves your device.