Loading page
About this tool
Password policy regex patterns from 8-char minimums to full complexity, with every lookahead explained and NIST-based caveats.
The Regex Library for Passwords provides five copy-ready password policy regular expressions — from the NIST SP 800-63B minimum of 8 characters, through the classic corporate upper/lower/digit and four-class complexity rules built from stacked (?=.*X) lookaheads, to a 12–64 character length-first passphrase policy. Every token of every pattern is explained, and each policy states plainly what it cannot do, because NIST's current guidance favours length and breached-password screening over composition rules.
Open Regex Library for Passwords on AltFTool — it loads instantly in your browser.
Pick one of the five policies from the 'Policy level' dropdown — from 'Minimum length only (NIST floor)' up to 'Passphrase policy (12–64, NIST style)'.
Type a made-up sample into 'Test a candidate password' to get a live Passes/Fails verdict against that policy (never test a real password).
Read the token-by-token breakdown and the policy's caveats, then click 'Copy regex' to copy the pattern in /source/flags form.
Each (?=.*X) assertion is broken down token by token, so the pattern is understood, not pasted blind.
The four-class pattern uses [^A-Za-z0-9] instead of a hardcoded symbol list, so no user's symbol is silently rejected.
Every policy notes where it conflicts with SP 800-63B, which discourages mandatory composition rules.
^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{8,}$ — four lookaheads each scan the string for one required class, then .{8,} enforces the length. Using [^A-Za-z0-9] for the special character accepts any symbol; patterns that enumerate symbols like [@$!%*?&] reject users whose symbol is not on the list.
It is a zero-width lookahead: from the start of the string it checks that some position ahead contains an uppercase letter, without consuming any characters. Because each lookahead returns to the start position, you can stack several to enforce independent 'must contain' rules in a single pattern before the final .{8,} does the real matching.
NIST SP 800-63B requires user-chosen passwords to be at least 8 characters and says verifiers should permit at least 64. Notably, it recommends against mandatory composition rules (forced symbols and digits) and instead advises checking candidates against lists of breached or commonly used passwords.
No — a regex can only check length and character classes, and predictable choices like Password1! sail through every composition rule. Combine a minimal length regex with a breached-password check and a strength estimator such as zxcvbn, and always hash with a slow algorithm like bcrypt or Argon2; this tool is informational, not a security review.