Skip to main content
hank-builds.com

Password Strength regex

Requires lowercase, uppercase, digit, special char, min 8 chars.

/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*]).{8,}$/gm
Try it

What it matches

Four lookaheads at the start of the line, each asserting that the rest of the string contains one class (lowercase, uppercase, digit, and one of !@#$%^&*) followed by a length check of at least eight characters. Lookaheads consume nothing, so all four test the same position and .{8,} does the measuring.

Railroad diagram

Read left to right. Every path through the diagram is a string the pattern accepts.

^ (?=...) . [a-z] (?=...) . [A-Z] (?=...) . \d (?=...) . [!@#$%^&*] {8,} . $

Drag to pan. Ctrl+scroll to zoom.

Breakdown

gFind all matches instead of stopping after the first
m^ and $ match the start/end of each line, not just the string
^Start of string
.*Any character, zero or more
[a-z]Match one of: Literal "a"–Literal "z"
.*Any character, zero or more
[A-Z]Match one of: Literal "A"–Literal "Z"
.*Any character, zero or more
\dDigit (0-9)
.*Any character, zero or more
[!@#$%^&*]Match one of: Literal "!", Literal "@", Literal "#", Literal "$", Literal "%", Literal "^", Literal "&", Literal "*"
.{8,}Any character, 8 or more times
$End of string

Test cases

Matches

  • Strong1!
  • P@ssw0rd
  • GoodP@ss1

Does not match

  • weak
  • nouppercase1!
  • NoDigitsHere!

Caveats

Composition rules like this are no longer recommended. NIST 800-63B advises checking length and screening against breached-password lists instead, since demanding a symbol mostly produces Password1!. The class also excludes most punctuation and every non-ASCII character, so it rejects strong passphrases.

Test this against your own input in the regex tester, browse the full pattern library, or check the syntax cheat sheet.