🔑

Regex for Strong Password

Requires at least 8 characters, one uppercase, one lowercase, one number, and one special character.

← Back to Pattern Library

Understanding The Regex Pattern

/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$/

Test in Visualizer ↗

Matches

StrongP@ss1
P4ssw0rd!

Non-Matches

weakpass
OnlyUpper1
NoSpecialChar1

How this Pattern Works

Enforcing strong password policies is essential for protecting user accounts from brute-force and dictionary attacks. This regular expression utilizes lookaheads to assert that the password string contains at least one lowercase letter, one uppercase letter, one digit, and one special character. Additionally, it enforces a minimum length of 8 characters. Implementing this pattern directly on the frontend provides immediate feedback to users, ensuring they meet the required security standards before submitting their registration form.

Implement The Regex In Your Code

javascript

const regex = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$/;
regex.test('StrongP@ss1');

python

import re
regex = re.compile(r'^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$')
bool(regex.match('StrongP@ss1'))

import "regexp"
// Go regexp does not support lookarounds. Use another library or string checks.

rust

use regex::Regex;
// Rust regex crate does not support lookarounds. Use multiple checks instead.