Back to all patterns
Strong Password Validation
Security
Validates a strong password (min 8 chars, 1 uppercase, 1 lowercase, 1 number, 1 special char).
/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$/How it works
This pattern uses positive lookaheads (?=...) to enforce that the string contains at least one lowercase letter, one uppercase letter, one digit, and one special character. It also enforces a minimum length of 8 characters.
Test Cases
Should Match
- StrongPass1!
- h4ck3r@B0y
Should NOT Match
- weak
- NoSpecialChar123
- short1!
Quick Summary
Enforces a minimum password complexity policy: at least 8 characters with at least one lowercase letter, one uppercase letter, one digit, and one special character from @$!%*?&.
Key Takeaways
Key Takeaways
- Uses four positive lookaheads to enforce character class requirements independently
- Minimum length is 8, adjust {8,} to {12,} for stronger policies
- Only allows the special characters @$!%*?&, extend the character class if your policy allows more
- Does not check for dictionary words or common passwords, use a dedicated library for that
Use Cases
When to use it
- Registration and password-change form validation
- Enforcing password policy in CLI tools or admin scripts
- Quick policy check before hashing and storing a password
Watch out
Common Mistakes
- Using this as the only password security measure, always hash with bcrypt/argon2 server-side
- Restricting special characters too aggressively, which reduces entropy
- Not communicating the policy clearly to users, leading to frustration
FAQ
Strong Password Validation, Frequently Asked
Is 8 characters enough for a strong password?
NIST SP 800-63B recommends a minimum of 8 characters but encourages longer passphrases. Consider requiring 12+ for sensitive applications.
Should I validate passwords with regex on the server?
Yes, but only as a policy check before hashing. Never store or log the plaintext password.