Validation
Validate a strong password
Enforce password rules: min length + upper + lower + digit + symbol.
Pattern
Regular expression
^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{8,}$How it works
Uses four look-aheads to require at least one lowercase, one uppercase, one digit, and one special character; then anchors to `.{8,}` for minimum length. Adjust the minimum length as needed.
Matches
- ▸Pa$$w0rd!
- ▸Strong1@X
- ▸aB1@aaaa
Non-matches
- ▸short1A!
- ▸alllowercase1!
- ▸NOLOWER1!
Common gotchas
Rigid password rules make weak, guessable passwords. Modern guidance (NIST 800-63B) prefers long passphrases with breached-password checks over complexity rules. Consider `zxcvbn` for real strength estimation.
Language snippets
JavaScript
const re = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{8,}$/;Python
re.match(r"^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{8,}$", password)Go
// Go regexp doesn't support look-aheads — validate with multiple simpler checks or use github.com/dlclark/regexp2Java
Pattern.compile("^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)(?=.*[^A-Za-z0-9]).{8,}$")Related patterns
Match an email address
[\w.+-]+@[\w-]+\.[\w.-]+
Match a URL
https?:\/\/[\w.-]+(?:\.[\w.-]+)+[\w\-._~:/?#\[\]@!$&'()*+,;=]*
Match an IPv4 address
(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)
Match an IPv6 address
(?:[A-Fa-f0-9]{1,4}:){7}[A-Fa-f0-9]{1,4}|::1|::
Match a UUID (v4)
[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}
Match a US phone number
(?:\+?1[-. ]?)?\(?[2-9][0-9]{2}\)?[-. ]?[2-9][0-9]{2}[-. ]?[0-9]{4}