Validation

Password (No Special Chars)

Validate passwords requiring at least one lowercase, one uppercase, one digit, and minimum 8 characters — no special characters required.

Try it in RegexPro →

Available in

JavaScript / ECMAScript code

jsJavaScript

const re = new RegExp("^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)[A-Za-z\\d]{8,}$", "");
const input = "Password1";
const matches = [...input.matchAll(re)];
console.log(matches.map(m => m[0]));

Uses `String.prototype.matchAll` for global iteration (Node 12+ / all modern browsers).

Python (re) code

pyPython

import re

pattern = re.compile(r"^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[A-Za-z\d]{8,}$")
input_text = "Password1"
for m in pattern.finditer(input_text):
    print(m.group(0))

Stdlib `re` module — no third-party dependency. Works on Python 3.6+.

Why it doesn't work in GO

Go's RE2 engine doesn't support lookarounds (`(?=...)`, `(?<=...)`, etc.) — they break the linear-time matching guarantee.

Approach

Restructure to capture the surrounding context as a group instead, or use JS / Python where lookarounds are available.

Read the full guide →

Workaround code in Go (RE2)

goGo (workaround)

package main

import (
	"fmt"
	"regexp"
	"unicode"
)

// RE2 doesn't support lookarounds. The fix: match a BROADER candidate
// without the lookaround, then verify the condition in Go code.
//
// Example: instead of `(?=.*\d)[A-Za-z\d]{8,}` (require a digit),
// match the candidate then check `HasDigit(s)` separately.

func HasDigit(s string) bool {
	for _, r := range s {
		if unicode.IsDigit(r) {
			return true
		}
	}
	return false
}

func main() {
	re := regexp.MustCompile(`[A-Za-z\d]{8,}`) // simplified, no lookaround
	input := "Password1 weakpass StrongerOne9"
	for _, candidate := range re.FindAllString(input, -1) {
		if HasDigit(candidate) { // the lookaround condition, in code
			fmt.Println(candidate)
		}
	}
}

Match a broader candidate without the lookaround, then verify the constraint in Go. Keeps the linear-time guarantee.

Pattern

regexengine-agnostic

^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[A-Za-z\d]{8,}$

Raw source: ^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[A-Za-z\d]{8,}$

How it works

Three positive lookaheads (?=.*[a-z]) (?=.*[A-Z]) (?=.*\d) require a lowercase letter, uppercase letter, and digit somewhere in the string. [A-Za-z\d]{8,}$ then matches 8+ alphanumerics. Lookaheads are zero-width so they don't consume — they're constraints, not consumers. Note: Go's RE2 does not support lookaheads, so this pattern won't compile there.