Loading page
About this tool
Password policy regex patterns from 8-char minimums to full complexity, with every lookahead explained and NIST-based caveats.
This library provides five copy-ready password policy regular expressions — from the NIST SP 800-63B minimum of 8 characters, through the classic corporate upper/lower/digit and four-class complexity rules built from stacked (?=.*X) lookaheads, to a 12–64 character length-first passphrase policy. Every token of every pattern is explained, and each policy states plainly what it cannot do, because NIST's current guidance favours length and breached-password screening over composition rules.
Open Regex Library for Passwords on AltFTool — it loads instantly in your browser.
Paste your code or data sample into the workspace.
Pick the format, conversion, or analysis you need.
Copy the polished result straight back into your project.
Each (?=.*X) assertion is broken down token by token, so the pattern is understood, not pasted blind.
The four-class pattern uses [^A-Za-z0-9] instead of a hardcoded symbol list, so no user's symbol is silently rejected.
Every policy notes where it conflicts with SP 800-63B, which discourages mandatory composition rules.
^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{8,}$ — four lookaheads each scan the string for one required class, then .{8,} enforces the length. Using [^A-Za-z0-9] for the special character accepts any symbol; patterns that enumerate symbols like [@$!%*?&] reject users whose symbol is not on the list.
It is a zero-width lookahead: from the start of the string it checks that some position ahead contains an uppercase letter, without consuming any characters. Because each lookahead returns to the start position, you can stack several to enforce independent 'must contain' rules in a single pattern before the final .{8,} does the real matching.
NIST SP 800-63B requires user-chosen passwords to be at least 8 characters and says verifiers should permit at least 64. Notably, it recommends against mandatory composition rules (forced symbols and digits) and instead advises checking candidates against lists of breached or commonly used passwords.
No — a regex can only check length and character classes, and predictable choices like Password1! sail through every composition rule. Combine a minimal length regex with a breached-password check and a strength estimator such as zxcvbn, and always hash with a slow algorithm like bcrypt or Argon2; this tool is informational, not a security review.