Developer
Encoders, converters & dev utilities
Regex for a Strong Password (Upper + Lower + Digit, 8+)
A classic password-strength regex is ^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$ — it uses three independent lookaheads to assert that the string contains at least one lowercase letter, one uppercase letter and one digit, and then .{8,} requires a minimum length of eight characters. Lookaheads are zero-width, so each one checks its condition without consuming characters, letting you layer multiple rules on a single pattern. This is a useful client-side hint, but it is worth knowing that modern guidance (for example NIST) favours length and screening passwords against known-breached lists over rigid composition rules — a long passphrase is stronger than a short "Complex1" that satisfies every character class. This JavaScript pattern is verified in CI against real examples and counter-examples. Copy it, test your own strings in the live in-browser tester, and pair it with a breach check rather than relying on composition alone. Free, no login.
Pattern: ^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$ (upper + lower + digit, min 8)
- Matches: Abcdef12 and StrongP4ss
- Rejects: short1A (too short), alllowercase1 (no uppercase) and NoDigitsHere (no digit)
- Each (?=…) is a zero-width lookahead that asserts a rule without consuming characters
- Prefer length + a breached-password check over rigid composition rules (NIST guidance)
Frequently asked questions
What is a regex for a strong password?
A common one is ^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$. The three lookaheads — (?=.*[a-z]), (?=.*[A-Z]) and (?=.*\d) — each independently require at least one lowercase letter, one uppercase letter and one digit somewhere in the string, and .{8,} enforces a minimum of eight characters. You can add another lookahead such as (?=.*[^A-Za-z0-9]) to require a symbol. It matches Abcdef12 and rejects a value that is too short or missing a required character class.
How do the lookaheads in a password regex work?
A lookahead (?=…) is a zero-width assertion: it checks that the pattern inside can match starting at the current position, but it does not advance or consume any characters. That is why you can stack several of them at the start of a password regex — each (?=.*X) scans ahead for an X anywhere in the string independently of the others. After all the assertions pass, .{8,} actually matches the characters and enforces the length. Without lookaheads you would have to enumerate every ordering of the required character types, which is impractical.