★ Identity & contact · regex

Regex for Strong Password

Four lookaheads each require one character class somewhere in the string, then .{12,} enforces the length. It's a common policy, though length matters far more than character classes.

Runs in your browser
No signup

Try the strong password pattern

Read it in plain English (best-effort)

^start of a line
(?=lookahead: what follows must match…
.any character except a newline
*zero or more of the previous
[a-z]one character from: a–z
)end of group
(?=lookahead: what follows must match…
.any character except a newline
*zero or more of the previous
[A-Z]one character from: A–Z
)end of group
(?=lookahead: what follows must match…
.any character except a newline
*zero or more of the previous
\da digit (0–9)
)end of group
(?=lookahead: what follows must match…
.any character except a newline
*zero or more of the previous
[^A-Za-z0-9]any one character except A–Z, a–z, 0–9
)end of group
.any character except a newline
{12,}12 or more of the previous
$end of a line

Test text

One sample per line works well with the m flag on anchored patterns.

Waiting for a pattern

The pattern, piece by piece

/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{12,}$/

Pattern explanation
Part	What it does
`(?=.*[a-z])`	lookahead: at least one lowercase letter somewhere
`(?=.*[A-Z])`	lookahead: at least one uppercase letter
`(?=.*\d)`	lookahead: at least one digit
`(?=.*[^A-Za-z0-9])`	lookahead: at least one symbol
`.{12,}`	then 12 or more characters of anything

What it accepts and rejects

Every sample below is checked automatically in JavaScript and Python. The tester above is preloaded with all of them, one per line.

Should match
Should match
`Tr0ub4dor&3xx`	✓
`C0rrect-Horse!`	✓
`Aa1!Aa1!Aa1!`	✓
`My$ecretPass9`	✓
`Founder#2026ok`	✓
`zZ9@zZ9@zZ9@`	✓

Should not match
Should not match
`short1!A`	✗
`alllowercase1!`	✗
`ALLUPPERCASE1!`	✗
`NoDigitsHere!!`	✗
`NoSymbols12345`	✗
`Aa1!Aa1!Aa1`	✗

Copy it into your code

Go noteGo's RE2 engine has no lookaheads, so check each rule separately. The Go tab shows a version without regex.

Language

const strongPasswordRe = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{12,}$/;

export function isValidStrongPassword(value) {
  return strongPasswordRe.test(value.trim());
}

When not to use regex for this

Current NIST guidance favours long passphrases and checking against breached-password lists over composition rules. Use a strength estimator like zxcvbn and the Have I Been Pwned range API; keep this regex only if a policy requires it.

Questions engineers actually ask

Are composition rules still recommended?

NIST SP 800-63B advises against mandatory composition rules and in favour of minimum length plus blocklists of common and breached passwords.

Why do lookaheads work here?

Each (?=…) checks a condition from the start without consuming characters, so all four rules apply to the same string.

What is catastrophic backtracking?

Some patterns, usually nested quantifiers like (a+)+, make a backtracking engine try an exponential number of paths on input that almost matches. The tester stops any run after 300ms, so a bad pattern can't freeze your tab. In production, that same pattern can take down a server (a ReDoS attack).