Security

Strong Password

Enforce strong passwords: min 8 chars, at least one lowercase, uppercase, digit, and special character.

Available in

JavaScript / ECMAScript code

jsJavaScript

const re = new RegExp("^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)(?=.*[^a-zA-Z\\d\\s]).{8,}$", "");
const input = "MyP@ssw0rd";
const matches = [...input.matchAll(re)];
console.log(matches.map(m => m[0]));

Uses `String.prototype.matchAll` for global iteration (Node 12+ / all modern browsers).

Python (re) code

pyPython

import re

pattern = re.compile(r"^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^a-zA-Z\d\s]).{8,}$")
input_text = "MyP@ssw0rd"
for m in pattern.finditer(input_text):
    print(m.group(0))

Stdlib `re` module — no third-party dependency. Works on Python 3.6+.

Why it doesn't work in GO

Go's RE2 engine doesn't support lookarounds (`(?=...)`, `(?<=...)`, etc.) — they break the linear-time matching guarantee.

Approach

Restructure to capture the surrounding context as a group instead, or use JS / Python where lookarounds are available.

Read the full guide →

Workaround code in Go (RE2)

goGo (workaround)

package main

import (
	"fmt"
	"regexp"
	"unicode"
)

// RE2 doesn't support lookarounds. The fix: match a BROADER candidate
// without the lookaround, then verify the condition in Go code.
//
// Example: instead of `(?=.*\d)[A-Za-z\d]{8,}` (require a digit),
// match the candidate then check `HasDigit(s)` separately.

func HasDigit(s string) bool {
	for _, r := range s {
		if unicode.IsDigit(r) {
			return true
		}
	}
	return false
}

func main() {
	re := regexp.MustCompile(`[A-Za-z\d]{8,}`) // simplified, no lookaround
	input := "Password1 weakpass StrongerOne9"
	for _, candidate := range re.FindAllString(input, -1) {
		if HasDigit(candidate) { // the lookaround condition, in code
			fmt.Println(candidate)
		}
	}
}

Match a broader candidate without the lookaround, then verify the constraint in Go. Keeps the linear-time guarantee.

Pattern

regexengine-agnostic

^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^a-zA-Z\d\s]).{8,}$

Raw source: ^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^a-zA-Z\d\s]).{8,}$

How it works

Uses four lookaheads from the start (^) to assert each required character class exists somewhere in the string, then .{8,} ensures minimum length, and $ anchors the end.