Regex for Password Validation
Enforce password strength rules with regex. Minimum length, character requirements, and common patterns for registration forms.
Formula Genius can generate a draft from a plain-English prompt. Supported formulas can be checked with sample cases; review the coverage on the result.
The formula
"Validate a password with at least 8 characters, one uppercase, one lowercase, one number, and one special character"
^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+\-=\[\]{}|;:'",.<>?/`~])[A-Za-z\d!@#$%^&*()_+\-=\[\]{}|;:'",.<>?/`~]{8,}$Uses lookaheads to check each requirement independently. Each (?=...) checks for one character type without consuming characters, so the order doesn't matter. The final character class + {8,} enforces minimum length.
Step-by-step breakdown
- ^ and $ anchor to full string (entire password must match)
- (?=.*[a-z]) — lookahead requiring at least one lowercase letter
- (?=.*[A-Z]) — lookahead requiring at least one uppercase letter
- (?=.*\d) — lookahead requiring at least one digit
- (?=.*[special chars]) — lookahead requiring at least one special character
- {8,} — minimum 8 characters total
Edge cases & warnings
- Lookaheads check requirements independently — the password 'aB1!' passes even though the required characters are scattered
- Unicode characters (accented letters, emoji) may not be covered by [a-zA-Z]
- Maximum length should also be enforced (e.g., {8,128}) to prevent ReDoS attacks
- Consider allowing spaces in passwords — they increase entropy significantly
Examples
"MyP@ssw0rd"
Valid (meets all requirements)"password"
Invalid (no uppercase, number, or special char)"Ab1!"
Invalid (less than 8 characters)Frequently asked questions
Should I use regex for password validation?
For front-end feedback, yes. For security, always validate server-side too. Regex catches format issues; bcrypt/argon2 handles storage.
Is complex password regex actually good security?
NIST guidelines now recommend length over complexity. A 16+ character passphrase is more secure than an 8-character complex password. Consider adjusting rules accordingly.
Can't find what you need?
Describe a formula in plain English. Formula Genius drafts and explains it, and can check supported formulas on sample cases.