Strong Password Regex

At least 12 characters with a lowercase letter, a capital, a digit and a symbol, each checked by a lookahead.

/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z\d]).{12,}$/

Piece by piece

1. ^the start of the text
2. (?=followed by (lookahead, not part of the match):
3. .*any character except a line break, repeated 0 or more times, as many as possible
4. [a-z]one of a–z
5. )end of followed by
6. (?=followed by (lookahead, not part of the match):
7. .*any character except a line break, repeated 0 or more times, as many as possible
8. [A-Z]one of A–Z
9. )end of followed by
10. (?=followed by (lookahead, not part of the match):
11. .*any character except a line break, repeated 0 or more times, as many as possible
12. \da digit (0–9)
13. )end of followed by
14. (?=followed by (lookahead, not part of the match):
15. .*any character except a line break, repeated 0 or more times, as many as possible
16. [^A-Za-z\d]any character except A–Z, a–z, a digit (0–9)
17. )end of followed by
18. .{12,}any character except a line break, repeated 12 or more times, as many as possible
19. $the end of the text

Examples

• Rules like these aren't what makes a password strong; length and not reusing it matter more. A long random passphrase beats them.

Other common patterns

• Email Address Regex
• URL Regex
• IPv4 Address Regex
• Date (YYYY-MM-DD) Regex
• UUID Regex
• Hex Colour Regex
• International Phone Number Regex
• 24-Hour Time Regex
• URL Slug Regex
• US ZIP Code Regex

Test any regular expression →