Regex for Password Strength
Regex that requires lowercase, uppercase, a digit and at least 8 characters, using lookaheads. Test passwords live and see why length matters most.
Part of the free Regex Tester. Runs in your browser — nothing is uploaded.
Regex for Password Strength
Lookaheads let one regex check several rules at once without caring about order. Each (?=...) asserts a requirement, and the final .{8,} enforces the length. Test sample passwords below.
Worked example: Passwords against the rule set
Pattern /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$/ — test strings
^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$
Passw0rdLong
shortA1
alllowercase1
NoDigitsHere
Correct-Horse-Battery-9Result for each line
✓ match Passw0rdLong ✗ no match shortA1 ✗ no match alllowercase1 ✗ no match NoDigitsHere ✓ match Correct-Horse-Battery-9
Practical tip
Current guidance (NIST) favors length over composition rules. Allow long passphrases, check against breached-password lists and avoid forced periodic changes.
How to use this Regex Tester
- 1Use the live tool above — it runs entirely in your browser and never uploads your data.
- 2Paste the sample from the worked example, or use your own input.
- 3Copy the result, then adapt the same steps in your editor, script, or pipeline.
Regex for Password Strength FAQs
What do the (?=...) groups do?
They are lookaheads: zero-width checks that the text ahead contains something, without consuming it, so many rules can apply at the same starting point.
Are complexity rules good security?
Less than people think. Longer passphrases and breach checking protect better than demanding symbols, which push users toward predictable patterns.
More Regex Tester pages
- Regex for Email ValidationA practical regex for email validation with test cases. Try the pattern against valid and invalid addresses and learn why perfect email regex does not exist.
- Regex for Phone NumbersTest a regex for phone numbers that accepts common US and international formats such as +1 555-123-4567. Try your own examples live.
- Regex for URL ValidationTest a regex that matches http and https URLs. Check it against valid and invalid links and learn when to use the URL constructor instead.
- Regex for an IPv4 AddressA tested regex for IPv4 addresses that limits each octet to 0–255. Try it on valid and invalid IPs such as 192.168.1.1 and 256.1.1.1.
- Regex for a YYYY-MM-DD DateRegex to match dates in YYYY-MM-DD format, restricting months to 01–12 and days to 01–31. Test it against valid and invalid dates.
- Regex for Hex Color CodesRegex that matches CSS hex colors like #fff and #1a2b3c. Try valid and invalid values and learn how to extend it for alpha channels.
- Regex for Username ValidationA username regex allowing letters, numbers and underscores with 3–16 characters. Test valid and invalid names and adapt the rules to your app.
- Regex to Extract Numbers From a StringExtract all numbers from text with the global regex \d+. See the matches, then extend the pattern for decimals and negative numbers.
- Regex for US ZIP CodesRegex that matches US ZIP codes in 5-digit and ZIP+4 formats. Test valid and invalid values like 90210 and 90210-1234.