How to turn a password policy into a regex
Set the minimum length and how many uppercase letters, lowercase letters, numbers and symbols a password needs. The tool writes a regular expression that enforces exactly those rules, plus an HTML pattern attribute and a short JavaScript check you can paste into a sign-up form. Type a password into the checker to see which rules it passes before you ship the policy.
How the regex works
Each rule becomes a lookahead at the start of the pattern. For example, (?=(?:.*[A-Z]){2}) means "somewhere in the password there are at least two uppercase letters". The final .{12,} sets the minimum length. Because lookaheads don't consume characters, the rules can appear in any order in the password. A symbol is any character that is not an A–Z letter, a digit or a space, so accented letters such as é also count as symbols.
Validate on the server too
Browser checks can be bypassed, so use the same regex or rules on your server. Length matters more than complexity: current NIST guidance favours longer passwords and checking against lists of breached passwords over strict character rules, so consider a minimum of 12 or more characters.
Frequently asked questions
- Is the generated password truly random? Yes. Characters are chosen with your browser's cryptographic random generator (
crypto.getRandomValues), and the result is shuffled with an unbiased Fisher–Yates shuffle. - How is strength measured? The meter estimates entropy from the password's length and the kinds of characters it uses. It is shown separately from your policy, because a password can meet a weak policy and still be easy to guess.
- What does "Exclude ambiguous characters" do? It leaves out characters that are easy to confuse: lowercase l and i, capital I and L, the letter O and o, and the digits 1 and 0.
- Is my password stored or sent anywhere? No. Generating and checking happen in your browser, and nothing is sent to a server.