Password Regex Validation Guide
Use password regex carefully for length and composition checks, with safer guidance for UX, security and server-side validation. This Formalint reference is written for working developers, DBAs and support engineers who need a repeatable debugging path instead of a one-line snippet with no context.
Use the notes below as a practical review order: understand the input, capture evidence, make one small change and verify the result before moving to the next assumption.
When to use this page
Design password checks that help users without creating fragile security theater. It is most useful when a small validation or debugging mistake can create noisy tickets, misleading logs or hard-to-review production changes.
Practical workflow
| Step | What to confirm |
|---|---|
| Prefer length first | Longer passwords usually matter more than a complicated symbol rule. |
| Explain the rule | Show users exactly which requirement is missing instead of saying invalid password. |
| Repeat on the server | Client-side checks improve feedback, but server-side validation owns enforcement. |
Example composition pattern
# At least 12 chars, one lowercase, one uppercase, one number
^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{12,}$Review checklist
- Set a minimum length that matches your product risk.
- Allow pasted passwords and password-manager generated values.
- Do not silently trim passwords unless the policy documents it.
- Check breached-password lists separately when your stack supports it.
- Rate-limit signup, login and reset endpoints.
Common mistake
A strict regex can reject strong password-manager values while allowing predictable human patterns. Keep policy simple and pair it with rate limiting and secure storage.
Formalint is strongest when the page helps the developer decide what the tool cannot prove. Treat every formatter, regex and command as one layer of evidence, not the whole truth.
Frequently asked questions
Should symbols be required?
Only if your policy really needs it. A high minimum length with password-manager support is often easier for users.
Is a password regex a security control?
It is only one validation rule. Hashing, storage, rate limits, MFA and reset flows matter more.
Related Formalint references
Continue with Regex Lookahead and Lookbehind, HTTP Security Headers Checklist, Developer Data Validation.