Password Regex Generator
Pick the rules a password must follow, test sample passwords as you type, and copy the JavaScript regex or a ready <input type="password"> with the pattern attribute. Nothing you type leaves your browser.
/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$/u<label for="password">Password</label>
<input type="password" id="password" name="password"
autocomplete="new-password"
pattern="(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}"
title="At least 8 characters, with a lowercase letter, an uppercase letter and a digit" required>Runs only in your browser. Don't type a password you really use.
- At least 8 characters fails
- A lowercase letter fails
- An uppercase letter fails
- A digit fails
Empty: the regex fails (the HTML pattern skips empty fields; required catches them).
How each lookahead works
A lookahead (?=...) checks that something appears somewhere in the password without moving forward, so the rules stack in any order. This is the Strong preset with No spaces ticked:
| Part | What it does |
|---|---|
^ | Start of the password. |
(?=.*[a-z]) | Looks ahead for at least one lowercase letter a-z. |
(?=.*[A-Z]) | Looks ahead for at least one uppercase letter A-Z. |
(?=.*\d) | Looks ahead for at least one digit 0-9. |
(?=.*[^A-Za-z0-9]) | Looks ahead for at least one character that is not an ASCII letter or digit, such as ! or #. A space or an accented letter like é also counts. |
(?!.*\s) | Negative lookahead: fails if the password contains a space, tab or other whitespace. |
.{12,} | Consumes the whole password: at least 12 characters. |
$ | End of the password, so nothing extra can follow. |
Use it in HTML, JavaScript or React
The snippets use the Strong preset. In HTML and React, paste the pattern without ^ and $; in JavaScript, keep the anchors and leave off the g flag.
HTML: the pattern attribute
<label for="password">Password</label>
<input type="password" id="password" name="password"
autocomplete="new-password"
pattern="(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{12,}"
title="At least 12 characters, with a lowercase letter, an uppercase letter, a digit and a symbol" required>JavaScript: test before you submit
// No g flag: a global regex keeps lastIndex between .test() calls.
const PASSWORD_RE = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{12,}$/u;
PASSWORD_RE.test("Abcdef1!xyz9"); // true
PASSWORD_RE.test("abc"); // falseReact: the same pattern as a prop
export function PasswordField() {
return (
<>
<label htmlFor="password">Password</label>
<input
type="password"
id="password"
name="password"
autoComplete="new-password"
pattern="(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{12,}"
title="At least 12 characters, with a lowercase letter, an uppercase letter, a digit and a symbol"
required
/>
</>
);
}Whatever the browser checks, check it again on the server; see server-side form validation.
Password regex FAQ
What is a good regex for password validation?
For 12 or more characters with a lowercase letter, an uppercase letter, a digit and a symbol, use ^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{12,}$. Each (?=...) lookahead checks one rule without consuming characters, and the final .{12,} checks the length. Drop a lookahead to drop that rule.
Why does the HTML pattern have no ^ or $?
The browser anchors the pattern attribute for you: it wraps it as ^(?: and )$ and compiles it with the v flag, so it must match the whole value. Leaving ^ and $ out keeps the pattern short; adding them does no harm.
Is a password regex in the browser enough security?
No. The pattern attribute and JavaScript checks only help honest visitors fix a password before they submit. Anyone can turn them off or post straight to your server, so the server must check the password again, then store only a salted hash made with a slow algorithm such as Argon2, bcrypt or scrypt.
Should I require uppercase letters, digits and symbols?
NIST SP 800-63B advises against composition rules like these and favours length: it tells verifiers not to require mixes of character types, to allow at least 64 characters, and to check new passwords against lists of known breached or common passwords. The NIST-style preset follows that with a length-only rule.
Does the symbol rule count spaces and accented letters?
Yes. [^A-Za-z0-9] matches any character that is not an ASCII letter or digit, so a space, é or an emoji satisfies it. Tick No spaces if you want to block whitespace, and remember that a regex can't tell a strong password from a common one like Password1!.
Regex patterns for form fields
Alphanumeric regex tester
Test letters and numbers, spaces, handles and Unicode patterns.
Email regex tester
Test email patterns against edge cases and your own list.
Phone number regex tester
Check numbers against E.164, US/Canada and digits-only patterns.
ZIP code regex
US ZIP, ZIP+4, Canadian and UK postal code patterns.
Number regex tester
Test digits, decimals, money and thousands separators.
Date regex tester
Date formats, strict ranges and leap-year aware ISO patterns.
Name regex tester
Validate names with accents, hyphens and apostrophes.
Username regex tester
Test username length, separators and reserved names.
IP address regex tester
Validate IPv4, IPv6 and CIDR input with strict octets.
URL regex tester
Check website fields with regex, type=url or new URL().
HTML pattern attribute
How browsers anchor and check a pattern on an input.
HTML required attribute
Stop a form from sending while a field is empty.
Validate a form with JavaScript
Use checkValidity, custom messages and your own rules.
Time regex tester
Validate 24-hour, AM/PM and ISO 8601 time formats.
Credit card regex tester
Match card brands by prefix and length, then run a Luhn check.
Hex color regex tester
Match hex, rgb() and hsl() colors with range checks and swatches.
UUID regex tester
Match UUID v4, v7 and GUIDs with version and variant checks.
Use your validation patterns as you assemble a form with our HTML contact form code or HTML form generator.
Related
More free form tools
Form backend cost calculator
Enter monthly submissions and compare the cheapest listed plan across eight form backends.
Email deliverability checker
Enter a domain to check its SPF, DMARC and MX records and get a plain-English fix for each.
SPF record checker
Look up a domain's SPF record, see each mechanism explained and count DNS lookups against the 10-lookup limit.
DMARC record generator
Pick a policy and report address and copy a ready _dmarc TXT record.
DMARC checker
Look up a domain's DMARC record and see the policy and every tag explained.
DKIM record checker
Enter a domain and selector to check its DKIM key, with presets for common senders.
SPF record generator
Tick your email providers and copy one SPF TXT record with a lookup count.
Contact form spam checker
Paste form HTML to audit its honeypot, endpoint, CAPTCHA markers and spam resistance.
Honeypot field generator
Generate a hidden anti-spam input with your chosen name and hiding technique.
Form action URL tester
Check a form action URL for reachability, CORS headers, POST acceptance and backend.
Email obfuscator
Encode your email so spam scrapers can't read it but people can still click it.
Mailto link generator
Build a mailto: URL with recipients, CC, BCC, subject and a pre-filled body.
HMAC-SHA256 generator
Generate and verify webhook signatures for common providers in your browser.
URL encoder and decoder
Encode text, build an x-www-form-urlencoded body or parse a query string.
UTM builder
Build campaign URLs with UTM parameters, tag a CSV in bulk and check tagged links.
HTML to JSX converter
Paste HTML and get JSX or a working React/Next.js form component.
Image to Base64 converter
Convert images to Base64 data URLs in your browser and copy HTML and CSS snippets.
Base64 to image converter
Paste a Base64 data URI to preview and download the decoded image.
Base64 decode & encode
Decode Base64 to readable UTF-8 text or encode text to Base64, locally in your browser.
URL to Base64 converter
Fetch a direct image URL in your browser and get its Base64 data URL.
AI form generator
Describe your form in plain English and copy working HTML.