Validation
Validate a strong password
Enforce password rules: min length + upper + lower + digit + symbol.
Pattern
Regular expression
^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{8,}$How it works
Uses four look-aheads to require at least one lowercase, one uppercase, one digit, and one special character; then anchors to `.{8,}` for minimum length. Adjust the minimum length as needed.
Matches
- ▸Pa$$w0rd!
- ▸Strong1@X
- ▸aB1@aaaa
Non-matches
- ▸short1A!
- ▸alllowercase1!
- ▸NOLOWER1!
Common gotchas
Rigid password rules make weak, guessable passwords. Modern guidance (NIST 800-63B) prefers long passphrases with breached-password checks over complexity rules. Consider `zxcvbn` for real strength estimation.
Language snippets
JavaScript
const re = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{8,}$/;Python
re.match(r"^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{8,}$", password)Go
// Go regexp doesn't support look-aheads — validate with multiple simpler checks or use github.com/dlclark/regexp2Java
Pattern.compile("^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)(?=.*[^A-Za-z0-9]).{8,}$")Frequently asked questions
What is the regex for Validate a strong password?
The pattern ^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{8,}$ matches Validate a strong password. Uses four look-aheads to require at least one lowercase, one uppercase, one digit, and one special character; then anchors to `.{8,}` for minimum length. Adjust the minimum length as needed.
What does this Validate a strong password pattern match?
It matches strings like Pa$$w0rd!, Strong1@X, aB1@aaaa, but rejects short1A!, alllowercase1!.
How do I use this pattern in JavaScript, Python, Go, Java?
Ready-to-run snippets are provided for JavaScript, Python, Go, Java. Copy the one for your language from the Language snippets section — each wraps the same core pattern in that language's regex API.
What are common pitfalls with a Validate a strong password regex?
Rigid password rules make weak, guessable passwords. Modern guidance (NIST 800-63B) prefers long passphrases with breached-password checks over complexity rules. Consider `zxcvbn` for real strength estimation.
Related patterns
Match an email address
[\w.+-]+@[\w-]+\.[\w.-]+
Match a URL
https?:\/\/[\w.-]+(?:\.[\w.-]+)+[\w\-._~:/?#\[\]@!$&'()*+,;=]*
Match an IPv4 address
(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)
Match an IPv6 address
(?:[A-Fa-f0-9]{1,4}:){7}[A-Fa-f0-9]{1,4}|::1|::
Match a UUID (v4)
[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}
Match a US phone number
(?:\+?1[-. ]?)?\(?[2-9][0-9]{2}\)?[-. ]?[2-9][0-9]{2}[-. ]?[0-9]{4}