Password regex

A password strength regex using lookaheads: at least 12 characters with lowercase, uppercase, a digit and a symbol. And why length matters more.

Pattern
/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{12,}$/

Matches

  • Correct-Horse-9
  • Tr0ub4dor&3xyz
  • aB3$aB3$aB3$

Doesn't match

  • password1234
  • SHORT1!a
  • ALLUPPER123!

Alternative: Length only (what NIST recommends)

^.{12,64}$

Notes

  • Each (?=…) is a lookahead that checks a rule without consuming characters, so the rules can appear in any order. See How regex works for an interactive demo.
  • NIST SP 800-63B advises against composition rules and recommends a minimum length plus checking against breached-password lists instead.

Code

JavaScript

const re = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{12,}$/;
re.test(value); // true or false

Python

import re

bool(re.fullmatch(r'(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{12,}', value))

Try it on your own input

The live tester adds the g and m flags so every line is checked separately.

Questions

Why use lookaheads?

Without them you would need a separate alternative for every order the character types could appear in. Lookaheads test each rule from the start of the string independently.

More patterns

Email regexPhone number regexURL regexIP address regexDate regexTime regex (24-hour and 12-hour)UUID regexHex color regex