Strong Password Regular Expression – Free, Online, Private

The pattern

The pattern is a policy check, not a strength meter. The whole string must be at least 12 characters and must contain one of each class: a lower-case letter, an upper-case letter, a digit, and a character that is none of those. Correct-Horse-1 matches. correcthorse fails the classes and the interesting part of the policy. Short-1a has the classes and fails the length. A long passphrase without a symbol fails, which is a reason to treat the pattern as a form rule you chose, not as a fact about security.

The source is ^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{12,}$. The flags on this page are m. i means case-insensitive. m means ^ and $ match at line breaks, which is how the sample can show several candidates. g is not set. The tester finds non-overlapping matches, and without g a pattern with no anchor still reports the matches it walks. The box under the title is a tester with this pattern and the sample already filled in. Edit either one. Nothing you type is uploaded. The same tester, without a preset, is the regex tool.

How to read it

(?=.*[a-z]) is a lookahead. It checks that a lower-case letter exists somewhere without consuming characters, so the next lookahead starts at the beginning too. The same shape is repeated for upper case, digits, and a symbol class [^A-Za-z0-9]. After the lookaheads, .{12,} consumes the line. ^ and $ with the m flag mean the start and end of each sample line, so a form that checks one password can keep the anchors and drop m. Lookaheads work in JavaScript and in Python. They do not work in Go's RE2 engine. The Go snippet on this page says so instead of pretending MustCompile will accept the pattern.

What it will not do

Unicode letters outside A-Z are invisible to the classes, so a perfectly good passphrase in another alphabet fails. There is no check against a list of common passwords. There is no check that the symbol is not a space. Spaces match the symbol class and the dot. Length 12 is a floor we picked for the example, not a recommendation from a particular standard. If your policy is 'a long passphrase', drop the symbol lookahead rather than teaching people to add a ! to a dictionary word. The tester shows the policy. It does not store the password.

A match is not a parsed value. An email pattern does not send mail, a UUID pattern does not allocate an id, and a password pattern does not store a password. When the next step needs a real parser, use one: the URL constructor, a date library, a semver library, or the converters on this site. The expression is the part you can see.

JavaScript, Python, and Go

The JavaScript snippet uses the RegExp constructor so the source does not have to be escaped for a literal slash. The Python snippet uses a normal string with the same escapes JSON would emit, which keeps \d as a regex digit class. Go's snippet uses a raw string. If the pattern contains a lookahead, the Go snippet says so and does not call MustCompile, because RE2 would reject it at runtime.

JavaScriptconst re = new RegExp("^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)(?=.*[^A-Za-z0-9]).{12,}$", "m");
const found = text.match(re);
console.log(found ? found[0] : "no match");

Pythonimport re

pattern = re.compile("^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)(?=.*[^A-Za-z0-9]).{12,}$", re.MULTILINE)
found = pattern.search(text)
print(found.group(0) if found else "no match")

Gopackage main

import "fmt"

func main() {
	// Go's regexp package is RE2 and does not support lookaheads.
	fmt.Println("use the JavaScript or Python snippet for this pattern")
}