WORKED EXAMPLE / ECMASCRIPT
Password format regex
A password format check requiring lowercase, uppercase, and a digit across 12 to 64 allowed characters.
Pattern
^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[A-Za-z\d@$!%*?&]{12,64}$- Flavor
- JavaScript (ECMAScript)
- Flags
- Flags: none
What it does
The lookaheads enforce three character categories while the final character class controls the accepted alphabet and total length. Treat it as an input-policy example, not a security score.
Token-by-token explanation
^Starts the check at the beginning of the password.
(?=.*[a-z])Looks ahead from the start and requires at least one lowercase ASCII letter.
(?=.*[A-Z])Looks ahead from the start and requires at least one uppercase ASCII letter.
(?=.*\d)Looks ahead from the start and requires at least one digit.
[A-Za-z\d@$!%*?&]Allows ASCII letters, digits, and the listed policy-approved symbols only.
{12,64}Requires between 12 and 64 allowed characters in total.
$Ends the check at the end of the password.
Test strings
Matches
CorrectHorse9Str0ng!Passw0rd
Does not match
shortA1!correcthorsebattery9
Common mistakes
- Calling a composition-rule match a strong password instead of measuring resistance to guessing and known-password reuse.
- Silently truncating passwords at the maximum length rather than rejecting or documenting the limit.
Limitations
- This regex checks format, not actual strength or breach history; use length-friendly policy, breached-password screening, rate limiting, and secure hashing as separate controls.
- Its explicit ASCII character class rejects spaces, accented letters, emoji, and unlisted symbols even when a product might reasonably allow them.