Password Regex Generator
Set your password requirements and get a ready-to-use regular expression for form validation, backend checks, or a database constraint.
^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[^\s]{8,64}$const pattern = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[^\s]{8,64}$/;
const isValid = pattern.test(userInput);<input type="password" pattern="^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[^\s]{8,64}$" required>How This Regex Works
| Fragment | Meaning |
|---|---|
^ / $ | Anchor the match to the entire string start and end |
(?=.*[a-z]) | Lookahead: somewhere ahead, there is a lowercase letter |
(?=.*[A-Z]) | Lookahead: somewhere ahead, there is an uppercase letter |
(?=.*\d) | Lookahead: somewhere ahead, there is a digit |
(?=.*[^A-Za-z0-9\s]) | Lookahead: somewhere ahead, there is a symbol |
[^\s]{8,64} | The actual match: 8-64 non-whitespace characters |
Lookaheads ((?=...)) check a condition without consuming characters, which is what allows multiple independent requirements to apply to the same string regardless of where each qualifying character appears.
What a Regex Can't Check
A regex validates format (length, presence of character types) but has no concept of whether a password is actually strong. It cannot detect:
- Whether the password appears in a known breach database
- Keyboard-walk patterns like
qwerty123or1qaz2wsx - Personal information (names, birthdays) embedded in the password
- Simple substitution patterns like
P@ssw0rd
A password can pass every check in this regex and still be trivially guessable. Pair format validation with a real strength check — see our Password Strength Checker for the kind of analysis a regex alone can't do.
Frequently Asked Questions
A lookahead like (?=.*[A-Z]) checks that the string contains an uppercase letter somewhere, without consuming characters or affecting the rest of the match — allowing multiple independent requirements to be combined in one pattern.
It works anywhere lookaheads are supported: JavaScript, PCRE (PHP and most tools), Python's re module, Java, and .NET. A small number of simplified engines (POSIX basic regex, some SQL dialects) don't support lookaheads and would need a different validation approach.
No — a regex is a useful first-line format check, but real strength assessment (breach lists, pattern detection) needs logic beyond what one expression can capture. Pair it with a proper strength check.