Password Validation Pattern

The canonical multi-rule example

"Password must be 8+ chars, contain at least one lowercase, one uppercase, and one digit." Without lookahead, this is a nightmare: enumerating every order in which the required characters can appear.

With stacked lookaheads, it's clean:

^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$

Reading left to right:

^ — start of string
(?=.*[a-z]) — somewhere ahead is a lowercase letter
(?=.*[A-Z]) — somewhere ahead is an uppercase letter
(?=.*\d) — somewhere ahead is a digit
.{8,} — actually consume 8+ characters
$ — end of string

The three lookaheads run AT THE START. Each peeks ahead to verify a constraint exists somewhere in the string. After all three pass, the pattern proceeds to consume 8+ characters.

Why this is the textbook example

It demonstrates everything important about lookaround:

Multiple constraints stacked at the same position.
Each constraint independent (order doesn't matter).
The final consume is separate from the constraints.
The result reads almost like a spec.

Adding more rules

Need at least one special character? Add (?=.*[!@#$%^&*]). Need to forbid spaces? Add (?!.*\s) (negative lookahead). The pattern grows linearly, not exponentially.

Code

Password validators·python

import re

# 8+ chars with lower, upper, digit
weak = re.compile(r'^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$')
bool(weak.match('Aa1aaaaa'))   # True
bool(weak.match('aaaaaaaaa'))  # False (no upper, no digit)
bool(weak.match('Aa1'))        # False (too short)

# Strong: 12+ chars, lower, upper, digit, special, no spaces
strong = re.compile(
    r'^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*])(?!.*\s).{12,}$'
)
bool(strong.match('Pippa@1234abc'))   # True
bool(strong.match('Pippa@1234'))      # False (only 10 chars)
bool(strong.match('Pippa @1234abc'))  # False (has space)

# Composing for readability with VERBOSE
password = re.compile(r'''
    ^                       # start
    (?=.*[a-z])             # at least one lowercase
    (?=.*[A-Z])             # at least one uppercase
    (?=.*\d)                # at least one digit
    (?=.*[!@#$%^&*])        # at least one special
    (?!.*\s)                # no whitespace
    .{12,}                  # 12+ chars total
    $                       # end
''', re.VERBOSE)

Password Validation Pattern

The canonical multi-rule example

Why this is the textbook example

Adding more rules

Code

External links

Exercise

Progress

Comments 0