Password Regex Generator & Tester
Build a password validation regex from rules — length, lowercase, uppercase, digit, symbol, no spaces, no repeats — for JavaScript, PHP, Python, Java, .NET or HTML.
Composition rules are a weak measure of strength; length matters most. NIST SP 800-63B recommends at least 8 characters (15 for single-factor), allowing at least 64, and checking against lists of breached passwords instead of requiring character types.
| Password | Result | Why |
|---|---|---|
| Passw0rd! | pass | — |
| password | fail | no uppercase, no digit, no symbol |
| Sh0rt! | fail | too short (6) |
| Aaa111!!!x | fail | "111" repeated |
| Good Pass1! | fail | contains a space |
| Tr0ub4dor&3 | pass | — |
Sign-up forms usually enforce password rules with a regular expression: a minimum length, at least one lowercase letter, one uppercase letter, one digit and one symbol, no spaces. Writing that pattern by hand means stacking lookaheads correctly and escaping symbols for each language. Tick the rules you need and get a ready regex with code for JavaScript, PHP, Python, Java, C# or an HTML pattern attribute — then paste sample passwords to see which pass and exactly which rule each one breaks.
How to use this tool
- Set the minimum and maximum length.
- Tick the character types that must appear, and list the allowed symbols if you want a specific set.
- Choose whether spaces and triple repeats are forbidden.
- Pick the language and copy the code.
- Type test passwords, one per line, to check the rules.
Formula
^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*[symbols])(?!.*\s)(?!.*(.)\1\1).{min,max}$
Each (?=.*X) is a lookahead that requires X somewhere; (?!.*\s) forbids whitespace and (?!.*(.)\1\1) forbids three identical characters in a row. The final part fixes the length (or, with "allow only", the permitted characters). Symbols are escaped for each flavour: JavaScript (u flag), PCRE, Python, Java and .NET escape \ ] [ ^ -, while the HTML pattern attribute, compiled with the v flag, needs most punctuation escaped.
Example
With the default rules (8–64 characters, all four types, no spaces, no triple repeats) 2 of the 6 samples pass: Passw0rd! and Tr0ub4dor&3. "password" lacks an uppercase letter, a digit and a symbol; "Sh0rt!" has only 6 characters; "Aaa111!!!x" repeats 1 and ! three times; "Good Pass1!" contains a space.
Frequently asked questions
Is a regex enough to make passwords secure?
No. It only enforces format. Length matters far more than character types, and NIST SP 800-63B advises checking new passwords against lists of breached passwords and allowing long passphrases. Always validate on the server, not only in the browser.
Why \A and \z instead of ^ and $?
In PCRE, Python, Java and .NET, $ also matches before a final line break, so "Passw0rd!\n" would slip through. \z (or \Z in Python, $ with /D in PHP) only matches at the very end.
How are emoji and accented letters counted?
JavaScript with the u flag, PHP with /u and Python count each code point once; Java and .NET count UTF-16 units, so an emoji counts as two. Letters such as é are not in a–z, so they count as symbols with the default symbol rule.
Sources
Last updated:
Page address with these inputs: https://kakao.mobile/tools/password-regex-tool/
Cite or embed this tool
kakaoCalc. (2026, November 8). Password Regex Generator & Tester. https://kakao.mobile/tools/password-regex-tool/
“Password Regex Generator & Tester.” kakaoCalc, 8 Nov. 2026, kakao.mobile/tools/password-regex-tool/.
Paste this code into your page. The widget runs in your visitors' browsers, shows no ads and keeps a link back to this page. Embedding terms