Strong Password
Enforce strong passwords: min 8 chars, at least one lowercase, uppercase, digit, and special character.
Try it in RegexPro →Available in
JavaScript / ECMAScript code
const re = new RegExp("^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)(?=.*[^a-zA-Z\\d\\s]).{8,}$", "");
const input = "MyP@ssw0rd";
const match = input.match(re);
console.log(match ? match[0] : null);Uses `String.prototype.match`, which returns the first match or null.
Python (re) code
import re
pattern = re.compile(r"^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^a-zA-Z\d\s]).{8,}$")
input_text = "MyP@ssw0rd"
for m in pattern.finditer(input_text):
print(m.group(0))Stdlib `re` module — no third-party dependency. Works on Python 3.6+.
Why it doesn't work in GO
Go's RE2 engine doesn't support lookarounds (`(?=...)`, `(?<=...)`, etc.) — they break the linear-time matching guarantee.
Approach
Restructure to capture the surrounding context as a group instead, or use JS / Python where lookarounds are available.
Read the full guide →Workaround code in Go (RE2)
package main
import (
"fmt"
"regexp"
"unicode"
)
// RE2 doesn't support lookarounds. The fix: match a BROADER candidate
// without the lookaround, then verify the condition in Go code.
//
// Example: instead of `(?=.*\d)[A-Za-z\d]{8,}` (require a digit),
// match the candidate then check `HasDigit(s)` separately.
func HasDigit(s string) bool {
for _, r := range s {
if unicode.IsDigit(r) {
return true
}
}
return false
}
func main() {
re := regexp.MustCompile(`[A-Za-z\d]{8,}`) // simplified, no lookaround
input := "Password1 weakpass StrongerOne9"
for _, candidate := range re.FindAllString(input, -1) {
if HasDigit(candidate) { // the lookaround condition, in code
fmt.Println(candidate)
}
}
}Match a broader candidate without the lookaround, then verify the constraint in Go. Keeps the linear-time guarantee.
Pattern
^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^a-zA-Z\d\s]).{8,}$Raw source: ^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^a-zA-Z\d\s]).{8,}$
How it works
Examples
Input
MyP@ssw0rdMatches
MyP@ssw0rd
Input
password123No match
—Input
SHORT1!No match
—Common use cases
- •User registration form validation
- •Password policy enforcement
- •Admin panel access controls
- •Security compliance checks
Related patterns
Password (No Special Chars)
ValidationValidate passwords requiring at least one lowercase, one uppercase, one digit, and minimum 8 characters — no special characters required.
bcrypt Password Hash
SecurityMatch bcrypt password hashes in their canonical $2a$/$2b$/$2y$ prefixed format.
Generic API Key
SecurityMatch generic long alphanumeric tokens (32+ chars) typical of API keys and access tokens.
Positive Lookahead (Password)
Text ProcessingUse positive lookahead `(?=...)` to require the password contain at least one digit and one uppercase letter.
Related concepts
Anchors: ^ and $ Explained
ConceptAnchors match positions, not characters. ^ asserts the start of the string (or line, with the m flag) and $ asserts the end.
Lookahead and Lookbehind
ConceptLookarounds assert a condition at a position without consuming characters. (?=X) is lookahead, (?<=X) is lookbehind. ! negates them.