Password Validation Regex
Regex for enforcing password strength: minimum length, uppercase, lowercase, digits, and special characters.
^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$About this pattern
This regex uses lookahead assertions to enforce multiple simultaneous requirements: at least one lowercase letter, one uppercase letter, one digit, and one special character, with a minimum total length of 8 characters. Each (?=...) is a positive lookahead that checks for the presence of a character class without consuming input, allowing all four checks to run independently. Modify the minimum length by changing {8,} to your desired minimum.
Worked examples
Each lookahead is checked independently, so a password failing any single requirement is rejected — including one that is long enough but has no special character.
Matches
- Abcdef1!
- Str0ng@Pass
Does not match
- alllowercase1!
- NOLOWERCASE1!
- NoDigitsHere!
- NoSpecial123
- Ab1!
FAQ
Is regex the best way to validate passwords?
Regex works for basic requirements (length, character classes). For a better user experience, consider checking strength progressively (showing a strength meter) rather than a binary pass/fail. Libraries like zxcvbn provide more nuanced strength estimation.