Password Policy Regex Generator

Generate a password policy regex

Validating that a password meets complexity rules is commonly done with a regular expression, but writing one with the right lookaheads is fiddly and error-prone. This generator builds the regex for you from simple choices: a minimum and maximum length, and whether an uppercase letter, lowercase letter, digit and symbol are each required. It uses positive lookaheads to enforce each requirement, then a length check, producing a pattern you can drop into form validation on the client or server.

For example, requiring all four character types with a minimum of eight characters yields a pattern with four lookaheads followed by a length range.

Validating passwords correctly

Lookaheads are the key technique: each one asserts that the string contains at least one character of a given class without consuming it, so several can be combined to require multiple character types. Getting the escaping and ordering right by hand is a frequent source of bugs, which this tool removes. The result works in JavaScript and most regex engines that support lookaheads.

Remember that a regex only checks composition and length; it cannot detect weak but compliant passwords like Password1, so pair it with a strength check or a breached-password check for real protection. All generation happens locally in your browser.

Related tools

• Password Strength Checker — Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
• Password Generator — Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
• Hash Generator — Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.
• Base64 Encoder/Decoder — Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.