RegexBuilder · regex answers
Regex for a strong password
/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{12,}$/Four lookaheads each assert that something exists somewhere ahead without consuming it, then .{12,} does the actual matching. Order does not matter, because none of the lookaheads move the cursor. Worth knowing: NIST's current guidance favours length and a breached-password check over composition rules like this one.
What each part does
| (?=.*[a-z]) | a lowercase letter exists somewhere ahead |
| (?=.*[A-Z]) | so does an uppercase letter |
| (?=.*\d) | so does a digit |
| (?=.*[^A-Za-z0-9]) | so does at least one non-alphanumeric character |
| .{12,} | and the string itself is twelve characters or longer |
Tested against real input
Every row below was run through the engine when this page was built. The third column is the substring the pattern actually matched.
| Input | Result | Matched |
|---|---|---|
| Str0ng!Passphrase | matches | Str0ng!Passphrase |
| aA1!aA1!aA1! | matches | aA1!aA1!aA1! |
| Str0ng!Pass | no match | — |
| alllowercase123! | no match | — |
| NOLOWERCASE123! | no match | — |
| NoDigits!!!!!! | no match | — |
The mistake to avoid
Chaining the conditions without lookahead — [a-z][A-Z]\d[^A-Za-z0-9] demands that exact order. Lookaheads exist precisely so the conditions stay independent.
Try it on your own text
Paste this pattern and your input, see each match highlighted with its capture groups, step through what the engine did, and get the equivalent syntax for JavaScript, Python, Java, Go and PCRE.
Open RegexBuilderOther regex answers
- Regex for an email address
- Regex for a US phone number
- Regex for an IPv4 address
- Regex for a URL
- Regex for a date in YYYY-MM-DD format
- Regex to match digits only
- Regex for alphanumeric characters
- Regex to find special characters
- Regex to match whitespace
- Regex to trim leading and trailing whitespace
- Regex for a UUID
- Regex for a hex colour code