Patterns for common data Updated November 2026

Regex for password

A password regex uses one lookahead per rule, then a length check: ^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^\w\s]).{8,}$ requires a lowercase letter, an uppercase letter, a digit, a symbol and at least 8 characters. Each (?=.*X) scans ahead without consuming text, so the rules can appear in any order.

Syntax

/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^\w\s]).{8,}$/

Examples

const pw = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^\w\s]).{8,}$/;
["Secret#42", "secret#42", "Secret42", "Sh0rt!"].map(s => pw.test(s))

Result: [true, false, false, false]

No uppercase, no symbol, too short.

/^(?!.*\s)(?=.*\d).{12,}$/.test("correct horse battery")

Result: false

A negative lookahead forbids whitespace; this one also has no digit.

const rules = { lower: /[a-z]/, upper: /[A-Z]/, digit: /\d/, symbol: /[^\w\s]/ };
Object.keys(rules).filter(k => !rules[k].test("Password1"))

Result: ["symbol"]

Test each rule separately so you can tell the user what is missing.

Common mistakes

Writing (?=[A-Z]) without .* only checks the first character; the lookahead needs (?=.*[A-Z]) to scan the whole string.
Dropping the final .{8,}: the lookaheads consume nothing, so the pattern still has to match the whole string.
Using \W for symbols: it excludes underscore and matches spaces; [^\w\s] or an explicit set like [!@#$%^&*] is clearer.
Capping length at 16 or so, which blocks passphrases; allow at least 64 characters.

Practice Regex for password

These drills check your answer on live data, free, no account needed.

Password rules with lookaheadsThe whole line must match. A valid password has at least 8 characters, no spaces, and at least one lowercase letter, one uppercase letter and one digit, in any order.
Lookahead: amounts before USDMatch every number (with optional decimals) that is followed by a space and USD. The whole match is compared, so it must not include the space or USD.
Negative lookahead: not starting with unThe whole line must match. Match lowercase words that do not begin with un.

Questions

Should I require special characters in passwords?

Current NIST guidance favors length and a breached-password check over composition rules, because rules push people toward predictable substitutions. If your policy still requires them, the lookahead pattern above enforces it.

How do I require at least two digits?

Repeat the group inside the lookahead: (?=(?:.*\d){2}). The same trick works for any count, for example (?=(?:.*[A-Z]){2}) for two uppercase letters.

Does the order of the lookaheads matter?

No. Each lookahead restarts from the beginning of the string and consumes nothing, so they are independent checks that all have to pass.

Lookahead (?=...) and (?!...)How lookahead checks what follows without consuming it: numbers before a unit, words without a prefix, thousands separators and file name filters.
Character classesWhat a character class matches, how ranges and negation work, what \d \w \s and their uppercase opposites mean, and what the dot does and does not match.
QuantifiersWhat * + ? {n} {n,} and {n,m} mean, how greedy matching works, how to repeat a group instead of a single character, and the silent {2, 3} mistake.
Negated character classHow [^...] matches any character except the listed ones, stripping non-digits, grabbing quoted text, splitting on a delimiter, and how it differs from (?!).