How the pattern works
| Part | Meaning |
|---|---|
(?=.*[a-z]) | Lookahead: at least one lower-case letter somewhere |
(?=.*[A-Z]) | At least one upper-case letter |
(?=.*\d) | At least one digit |
(?=.*[^A-Za-z0-9]) | At least one symbol |
.{8,} | Eight or more characters in total |
Code examples
JavaScript
const re = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{8,}$/;
re.test(value); // true or falsePython
import re
bool(re.fullmatch(r'(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{8,}', value))PHP
preg_match('/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{8,}$/', $value) === 1;Notes and limitations
Each lookahead checks one rule without consuming characters, so the rules can appear in any order. Current NIST guidance favors length (15+ characters) and a check against breached passwords over composition rules — consider a length-only rule plus a strength meter. Generate one with the Password Generator.
Regex TesterType a pattern and watch matches highlight live in your test text.
Open the tool Frequently asked questions
What is the regex for strong password?
/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{8,}$/ — it matches the whole string. See the table above for what each part does.
Which examples match?
Of the examples tested, these match: Passw0rd!, C0rrect-Horse, aB3$efgh. The others don’t.
How do I test this regex?
Click “Open in Regex Tester” — the pattern, flags and sample text load automatically, and matches highlight as you edit.