JavaScript Notes
HubYour First JavaScript Program — Hello World & Beyond Complete Guide 2026History of JavaScript — Complete Timeline from 1995 to 2026How JavaScript Runs — Complete Guide to Execution, Call Stack & Event LoopJavaScript Engine Explained — V8, JIT Compilation & How Code Gets FastJavaScript Use Cases — 15 Things You Can Build with JavaScript (2026)JavaScript vs Other Languages — Complete Comparison Guide 2026What is JavaScript? Complete BeginnerWhy Learn JavaScript in 2026? Career, Salary, Scope & Benefits GuideJavaScript Break Statement Tutorial – Complete Guide with ExamplesJavaScript Break and Continue Statements – Complete Guide with ExamplesJavaScript Continue Statement Tutorial – Skip Iterations with ExamplesJavaScript Do While Loop Tutorial – Execute at Least Once with ExamplesJavaScript Do-While Loop Tutorial – Complete Guide with ExamplesJavaScript For Loop Tutorial – Complete Guide with ExamplesJavaScript If Statement Tutorial – Conditional Logic with ExamplesJavaScript If Else Statement Tutorial – Complete Guide with ExamplesJavaScript If Statement Tutorial – Complete Guide with ExamplesJavaScript Nested If Statement Tutorial – Multi-Level Conditions with ExamplesNested Loops in JavaScriptJavaScript Control Flow Practice Programs – 20+ Exercises with SolutionsJavaScript Switch Statement Tutorial – Case Matching with ExamplesSwitch Statement in JavaScriptJavaScript While Loop Tutorial – Complete Guide with ExamplesJavaScript Arrow Functions Tutorial – Syntax, Use Cases & this BindingJavaScript Callback Functions Explained – Synchronous & AsynchronousJavaScript Closures Explained – Lexical Scope, Private State & MemoryJavaScript Function Declaration Tutorial – Hoisting, Syntax & ScopeJavaScript Function Expression Tutorial – Anonymous, Named & AssignedJavaScript Higher Order Functions Tutorial – map, filter, reduce & Custom HOFsJavaScript IIFE Explained – Immediately Invoked Function ExpressionJavaScript Functions Practice Programs – 20+ Exercises with SolutionsJavaScript Recursion Tutorial – Call Stack, Base Case & Recursive PatternsJavaScript Array Basics - Complete BeginnerJavaScript Array Methods - Complete Reference Guide with ExamplesJavaScript Array Programs - 20+ Practice Problems with SolutionsJavaScript Arrays Basics - Complete Guide with Examples & DiagramsJavaScript Array filter() Method - Complete Tutorial with ExamplesJavaScript filter() Method — Complete Guide with Examples 2026JavaScript Array find() Method - Complete Tutorial with ExamplesJavaScript find() & findIndex() — Complete Guide 2026JavaScript Array map() Method - Complete Tutorial with ExamplesJavaScript map() Method — Transform Arrays Complete Guide 2026JavaScript map() vs forEach() - Key Differences with ExamplesJavaScript Array push() and pop() - Complete Tutorial with ExamplesJavaScript Array reduce() Method - Complete Tutorial with ExamplesJavaScript reduce() Method — Complete Deep Dive with Examples 2026JavaScript Array shift() and unshift() - Complete Tutorial with ExamplesJavaScript Array sort() Method - Complete Tutorial with ExamplesJavaScript splice() vs slice() - Complete Tutorial with ExamplesJavaScript Object Destructuring - Complete Guide with ExamplesJavaScript Objects - Complete Guide to Object Basics with ExamplesJavaScript Object Methods - Built-in Methods & Custom Methods Complete GuideJavaScript Object Programs - Practice Problems with SolutionsJavaScript Object Properties - Keys, Values, Descriptors & Dynamic PropertiesJavaScript Rest Operator (...) - Parameters, Destructuring & Complete GuideJavaScript Spread Operator (...) - Complete Guide with ExamplesJavaScript this Keyword - Complete Guide with Binding Rules & ExamplesJavaScript String Basics - Complete Guide to Strings with ExamplesJavaScript String Methods - Complete Reference with Examples & OutputJavaScript String Programs - Practice Problems with SolutionsJavaScript String Replacing - replace(), replaceAll() & Regex Patterns GuideJavaScript String Searching Methods - includes, indexOf, startsWith, match GuideJavaScript Template Literals (ES6) - Complete Guide with Tagged TemplatesJavaScript DOM Changing Content - textContent, innerHTML, setAttribute Complete GuideJavaScript DOM Changing Styles - CSS Manipulation, classList & getComputedStyleJavaScript DOM Creating Elements - createElement, appendChild, DocumentFragment GuideJavaScript DOM Introduction - Complete Guide to Document Object ModelJavaScript DOM Traversal - Navigate Parent, Child & Sibling NodesJavaScript DOM Forms - Form Handling, Validation & FormData Complete GuideJavaScript localStorage - Complete Guide to Web Storage APIlocalStorage vs sessionStorage - JavaScript Web Storage Comparison GuideJavaScript DOM Removing Elements - remove(), removeChild() Complete GuideJavaScript DOM Selecting Elements - querySelector, getElementById Complete GuideJavaScript sessionStorage - Complete Guide to Session-Based Web StorageJavaScript Click Event - addEventListener, Event Handler Complete GuideEvent Bubbling in JavaScript – Complete Guide with Examples (2026)Event Capturing in JavaScript – Complete Guide to Capture Phase (2026)Event Delegation in JavaScript – Complete Guide with Examples (2026)JavaScript Event Object – Complete Guide with Examples (2026)JavaScript Form Events – Complete Guide with Examples (2026)JavaScript Keyboard Events – Complete Guide to keydown, keyup & Key Properties (2026)JavaScript Mouse Events – Complete Guide with Examples (2026)JavaScript Async Await - Complete Guide with Examples & Error HandlingJavaScript Call Stack - Complete Guide with Visual Diagrams & ExamplesJavaScript Callback Queue (Task Queue) - Complete Guide with DiagramsJavaScript Callbacks - Complete Guide with Callback Hell & PatternsJavaScript Event Loop - Complete Guide with Visual Diagrams & ExamplesJavaScript Fetch API - Complete Guide with Examples, Error Handling & Async/AwaitJSON in JavaScript - Complete Guide: Parse, Stringify, Fetch & Error HandlingJavaScript Promise.all, Promise.race, Promise.any, Promise.allSettled — Complete Guide 2026JavaScript Promises - Complete Guide with Chaining, Error Handling & Event LoopSynchronous vs Asynchronous JavaScript — Complete Explanation 2026JavaScript Web APIs - Complete Guide: setTimeout, fetch, DOM Events & MoreClosures in JavaScript — Complete Guide with Examples 2026Hoisting in JavaScript — Complete Guide with Examples 2026Prototype in JavaScript — Complete Guide with Examples 2026Scope in JavaScript — Complete Guide with Examples 2026Browser Object Model (BOM) in JavaScript — Complete GuideCanvas API in JavaScript — Complete Drawing & Animation GuideDrag and Drop API in JavaScript — Complete TutorialGeolocation API in JavaScript — Get User Location TutorialHistory API in JavaScript — SPA Routing & pushState GuideNotification API in JavaScript — Push Notifications TutorialService Workers in JavaScript — Offline, Caching & PWA GuideWeb Storage API in JavaScript — localStorage & sessionStorage GuideWeb Workers in JavaScript — Multithreading & Background Tasks GuideJavaScript Interview — Behavioral Questions and Soft Skills Guide 2026Common JavaScript Interview Mistakes — What to Avoid 2026JavaScript Interview Tips — Strategy and Preparation Guide 2026JavaScript Mock Interview — Practice Questions with Solutions 2026JavaScript System Design — Frontend Architecture Interview Guide 2026JavaScript apply() Method - Complete Guide with ExamplesJavaScript bind() Method - Complete Guide with ExamplesJavaScript call() Method - Complete Guide with ExamplesJavaScript call() vs apply() vs bind() - Complete Comparison GuideJavaScript Currying - Complete Guide with ExamplesJavaScript Debounce - Complete Guide with Timeline DiagramsJavaScript Execution Context - Complete Guide with Stack DiagramsJavaScript Garbage Collection - Memory Lifecycle & Mark-and-Sweep GuideJavaScript Generators - Complete Guide with yield and IterationJavaScript Hoisting - Complete Guide with var, let, const & FunctionsJavaScript Iterators - Complete Guide with Iterator ProtocolJavaScript Lexical Scope - Complete Guide with Scope Chain DiagramsJavaScript Memory Management - Complete Guide with Lifecycle DiagramsJavaScript Modules - Complete Guide with import export ExamplesJavaScript Scope - Complete Guide with var, let, const & Scope ChainJavaScript Symbols - Complete Guide with Well-Known SymbolsJavaScript Throttle - Complete Guide with Timeline DiagramsJavaScript Comments Complete Guide – Single Line, Multi-line & JSDoc with ExamplesJavaScript Data Types Complete Guide – Primitives, Objects & typeof with ExamplesJavaScript Input and Output Complete Guide – console.log, prompt, alert & DOM with ExamplesJavaScript Keywords Complete Guide – Reserved Words List with Examples for BeginnersJavaScript null vs undefined – Complete Guide with Differences, Examples & Interview Q&AJavaScript Operators Complete Guide – Arithmetic, Comparison, Logical & More with ExamplesJavaScript Strict Mode Complete Guide – JavaScript Type Conversion Complete Guide – Explicit & Implicit Coercion with ExamplesJavaScript var vs let vs const – Complete Guide with Scope, Hoisting & Best PracticesJavaScript Variables Complete Guide – Declaration, Naming Rules & Memory Model for BeginnersDeque (Double-Ended Queue) in JavaScript — Complete GuideLinked List in JavaScript — Nodes, Pointers & Operations GuideJavaScript Map — Key-Value Data Structure Complete GuideJavaScript Numbers — IEEE 754, Precision, and Number Methods GuidePriority Queue in JavaScript — Min Heap Implementation GuideQueue Data Structure in JavaScript — FIFO, Enqueue & Dequeue ExplainedJavaScript Set — Unique Values Data Structure GuideSorting Algorithms in JavaScript — Bubble, Merge, Quick Sort GuideStack Data Structure in JavaScript — LIFO, Push, Pop ExplainedJavaScript Typed Arrays — ArrayBuffer, Int32Array, Float64Array GuideJavaScript WeakMap — Weak References, Memory Management GuideJavaScript WeakSet — Complete Guide with Examples 2026Applications of JavaScript — Where JS is Used in 2026 Complete GuideJavaScript Backend Frameworks — Node.js, Express, NestJS Complete Guide 2026JavaScript Frontend Libraries — React, Vue, Angular, Svelte Complete Overview 2026JavaScript Full-Stack Frameworks — Next.js, Remix, Astro Complete Guide 2026JavaScript Career Paths & Jobs — Salary, Roles & Roadmap 2026JavaScript Libraries vs Frameworks — Difference & Examples Complete Guide 2026JavaScript Custom Errors – Extend Error Class, Custom Error Types & instanceofJavaScript Debugging – console Methods, DevTools, Breakpoints & Error Stack TracesJavaScript throw Statement – Throw Errors, Custom Messages & Error TypesJavaScript Try Catch Finally – Error Handling Complete GuideTop 30 JavaScript Closure Interview Questions & Answers 2026Top 30 JavaScript Coding Interview Questions 2026 (With Solutions)Top 25 JavaScript Event Loop Interview Questions & Answers 2026Top 50 JavaScript Interview Questions & Answers 2026Top 30 JavaScript Promise Interview Questions & Answers 202650 Tricky JavaScript Output Questions 2026 (With Answers)Build a JavaScript Calculator - Step by Step Project TutorialBuild a JavaScript Image Carousel - Step by Step Project TutorialBuild a JavaScript Counter Application - Step by Step Project TutorialBuild a JavaScript Digital Clock - Step by Step Project TutorialBuild a Dynamic Resume Builder in JavaScript - Step by Step TutorialBuild a JavaScript Email Validator - Step by Step Project TutorialBuild a JavaScript Employee Database Management App - Step by Step TutorialBuild a JavaScript Expense Tracker - Step by Step Project TutorialBuild a GitHub Profile Search App in JavaScript - Step by Step TutorialBuild a JavaScript Image Slider - Step by Step Project TutorialBuild a JavaScript Multi-Step Progress Bar - Step by Step TutorialBuild JavaScript Nested Chat Comments - Step by Step Project TutorialBuild a JavaScript Notes App - Step by Step Project TutorialBuild a JavaScript OTP Input Field - Step by Step Project TutorialBuild a JavaScript Palindrome Checker - Step by Step Project TutorialBuild a JavaScript Price Range Slider - Step by Step Project TutorialBuild a JavaScript Prime Number Checker - Step by Step Project TutorialBuild a JavaScript QR Code Generator - Step by Step Project TutorialBuild a JavaScript QR Code Scanner - Step by Step Project TutorialBuild a JavaScript Quiz App - Step by Step Project TutorialBuild a JavaScript Random Number Generator - Step by Step TutorialBuild a JavaScript Random Password Generator - Step by Step TutorialJavaScript Image Resize & Compress — Canvas API Project 2026JavaScript Responsive Admin Dashboard — DOM & CSS Project 2026JavaScript Show/Hide Password Toggle — Beginner DOM Project 2026JavaScript Sortable Filterable Table — DOM & Array Methods Project 2026JavaScript Stopwatch Project — setInterval & DOM Tutorial 2026JavaScript Student Grade Calculator — Arrays & Logic Project 2026JavaScript Task Scheduler Project — CRUD & localStorage Tutorial 2026JavaScript Tic-Tac-Toe Game — DOM Manipulation Project Tutorial 2026JavaScript Toast Notification Project — Custom Alerts Tutorial 2026Build a Todo App in JavaScript - Step by Step Project TutorialJavaScript Unicode Character Value Finder — charCodeAt & fromCharCode Project 2026JavaScript Weather App Project — Fetch API & DOM Complete Tutorial 2026JavaScript Cheat Sheet 2026 — Complete Quick ReferenceImportant JavaScript Concepts Every Developer Must Know in 2026JavaScript One Shot Notes 2026 — Complete JS in One PageJavaScript Quick Revision Notes — Interview Prep in 30 Minutes 2026Abstraction in JavaScript OOP – Hide Complexity, Expose SimplicityJavaScript Classes Tutorial – ES6 Class Syntax, Inheritance & MoreJavaScript Constructor Functions – new Keyword, Prototype & OOP PatternsEncapsulation in JavaScript – Private Fields, Getters, Setters & Data ProtectionJavaScript Inheritance – extends, super, and Prototype-Based InheritanceObject-Oriented Programming in JavaScript – OOP Concepts Complete GuideJavaScript OOP Projects – Build Real-World Apps with Classes & OOPPolymorphism in JavaScript – Method Overriding, Duck Typing & Many FormsJavaScript Prototype Chain – How Property Lookup Works in JavaScriptJavaScript Prototypes – Prototype-Based Inheritance, Object.create & prototype PropertyJavaScript Advanced Practice Problems — 15+ Interview-Level Challenges 2026JavaScript Assignments — 10 Project-Based Learning Tasks 2026JavaScript Beginner Practice Problems — 20+ Coding Exercises 2026JavaScript Coding Challenges — 25 Interview-Style Problems 2026JavaScript Intermediate Practice Problems — 20+ Coding Challenges 2026JavaScript MCQs — 50 Multiple Choice Questions with Answers 2026JavaScript Regex Character Classes – [abc], [^abc], Ranges & ShortcutsJavaScript Regex Email Validation – Pattern, Edge Cases & Best PracticesJavaScript Regex Flags – g, i, m, s, u, y Flags Explained with ExamplesJavaScript Regex Groups – Capturing, Non-Capturing & Named GroupsJavaScript Number Validation with Regex — Complete Patterns & Examples 2026JavaScript Password Validation with Regex — Strength Checker & Patterns 2026JavaScript Regex Quantifiers – *, +, ?, {n,m}, Greedy vs Lazy MatchingJavaScript Regex Basics – Regular Expressions Tutorial for BeginnersJavaScript Regex Projects — 10 Practical Mini-Projects with Code 2026JavaScript URL Validation with Regex — Complete Patterns & Examples 2026JavaScript Username Validation with Regex — Patterns & Form Examples 2026JavaScript TutorialJavaScript Lazy Loading — Images, Modules & Components Complete Guide 2026JavaScript Performance Optimization — Speed Up Your Code Complete Guide 2026JavaScript Unit Testing with Jest — Complete Guide for Beginners 2026
Learn password validation regex in JavaScript. Build strength checker, validate patterns with lookaheads, and create real-time password validators.
Introduction
Password validation is one of the most critical aspects of web application security. Every sign-up form, login page, and account settings page requires robust password validation to ensure users create strong, secure passwords.
Using Regular Expressions (Regex) in JavaScript, we can enforce password policies on the client side — checking for minimum length, uppercase letters, lowercase letters, digits, and special characters — all in real time before the form is submitted.
Why password validation matters:
- Security: Weak passwords are the #1 cause of account breaches
- User Experience: Real-time feedback helps users create compliant passwords
- Compliance: Many standards (PCI-DSS, HIPAA) require password complexity rules
- Cost Savings: Preventing weak passwords reduces breach remediation costs
In this tutorial, we'll build password validation from scratch using JavaScript regex — starting with individual checks and combining them into a full-featured password strength meter.
Text Diagram — Password Regex Breakdown
Example
┌─────────────────────────────────────────────────────────────────────┐
│ STRONG PASSWORD REGEX BREAKDOWN │
│ │
│ /^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[!@#$%^&*]).{8,}$/ │
│ │
│ ┌──────┐ │
│ │ ^ │ ──► Start of string (anchor) │
│ └──────┘ │
│ │ │
│ ▼ │
│ ┌──────────────┐ │
│ │ (?=.*[A-Z]) │ ──► Lookahead: at least 1 UPPERCASE letter │
│ └──────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────────┐ │
│ │ (?=.*[a-z]) │ ──► Lookahead: at least 1 lowercase letter │
│ └──────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────────┐ │
│ │ (?=.*\d) │ ──► Lookahead: at least 1 DIGIT (0-9) │
│ └──────────────┘ │
│ │ │
│ ▼ │
│ ┌────────────────────┐ │
│ │ (?=.*[!@#$%^&*]) │ ──► Lookahead: at least 1 SPECIAL char │
│ └────────────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────┐ │
│ │ .{8,} │ ──► Match any character, minimum 8 times │
│ └──────────┘ │
│ │ │
│ ▼ │
│ ┌──────┐ │
│ │ $ │ ──► End of string (anchor) │
│ └──────┘ │
│ │
│ KEY CONCEPT: Lookaheads (?=...) check conditions WITHOUT │
│ consuming characters. They all start from position 0. │
│ After all lookaheads pass, .{8,} matches the actual string. │
└─────────────────────────────────────────────────────────────────────┘
Password Requirements — Individual Regex Patterns
Let's break down each requirement into its own regex pattern:
1. Minimum 8 Characters
js example
const minLengthRegex = /.{8,}/;
console.log(minLengthRegex.test("hello")); // too short
console.log(minLengthRegex.test("helloWorld")); // 10 chars
console.log(minLengthRegex.test("12345678")); // exactly 8Output
false true true
2. At Least One Uppercase Letter
Example
const uppercaseRegex = /(?=.*[A-Z])/;
console.log(uppercaseRegex.test("hello")); // no uppercase
console.log(uppercaseRegex.test("Hello")); // has 'H'
console.log(uppercaseRegex.test("hELLO")); // has uppercase
Output
false true true
3. At Least One Lowercase Letter
Example
const lowercaseRegex = /(?=.*[a-z])/;
console.log(lowercaseRegex.test("HELLO")); // no lowercase
console.log(lowercaseRegex.test("Hello")); // has 'ello'
console.log(lowercaseRegex.test("hello")); // all lowercase
Output
false true true
4. At Least One Digit
js example
const digitRegex = /(?=.*\d)/;
console.log(digitRegex.test("hello")); // no digits
console.log(digitRegex.test("hello1")); // has '1'
console.log(digitRegex.test("2026code")); // has digitsOutput
false true true
5. At Least One Special Character
Example
const specialCharRegex = /(?=.*[!@#$%^&*])/;
console.log(specialCharRegex.test("hello123")); // no special
console.log(specialCharRegex.test("hello@123")); // has '@'
console.log(specialCharRegex.test("P@$$w0rd!")); // has multiple
Output
false true true
6. Combined Strong Password Regex
Example
const strongPasswordRegex = /^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[!@#$%^&*]).{8,}$/;
console.log(strongPasswordRegex.test("weak")); // fails multiple rules
console.log(strongPasswordRegex.test("Hello123")); // no special char
console.log(strongPasswordRegex.test("Hello@123")); // passes all rules
console.log(strongPasswordRegex.test("My$ecure2026!")); // strong password
Output
false false true true
Code Examples
Example 1: Basic Length Check Function
js example
function checkLength(input, minLength = 8) {
const regex = new RegExp(`.{${minLength},}`);
return regex.test(input);
}
console.log(checkLength("abc")); // too short
console.log(checkLength("abcdefgh")); // exactly 8
console.log(checkLength("abc", 3)); // custom min = 3
console.log(checkLength("ab", 3)); // custom min = 3, too shortOutput
false true true false
Example 2: Uppercase Requirement Check
Example
function hasUppercase(input) {
return /[A-Z]/.test(input);
}
function countUppercase(input) {
const matches = input.match(/[A-Z]/g);
return matches ? matches.length : 0;
}
console.log(hasUppercase("hello world")); // no uppercase
console.log(hasUppercase("Hello World")); // has uppercase
console.log(countUppercase("Hello World")); // count: 2
console.log(countUppercase("HeLLo WoRLD")); // count: 5
Output
false true 2 5
Example 3: Full Password Validation Function
Example
function validatePassword(input) {
const rules = [
{ regex: /.{8,}/, message: "At least 8 characters" },
{ regex: /[A-Z]/, message: "At least 1 uppercase letter" },
{ regex: /[a-z]/, message: "At least 1 lowercase letter" },
{ regex: /\d/, message: "At least 1 digit" },
{ regex: /[!@#$%^&*]/, message: "At least 1 special character" }
];
const results = rules.map(rule => ({
passed: rule.regex.test(input),
message: rule.message
}));
const allPassed = results.every(r => r.passed);
const failed = results.filter(r => !r.passed).map(r => r.message);
return { valid: allPassed, failed };
}
console.log(validatePassword("hello"));
console.log(validatePassword("Hello123"));
console.log(validatePassword("Hello@123"));
Output
{ valid: false, failed: ["At least 8 characters", "At least 1 uppercase letter", "At least 1 digit", "At least 1 special character"] }
{ valid: false, failed: ["At least 1 special character"] }
{ valid: true, failed: [] }Example 4: Password Strength Meter Function
Example
function getPasswordStrength(input) {
let score = 0;
// Length checks
if (input.length >= 8) score += 1;
if (input.length >= 12) score += 1;
if (input.length >= 16) score += 1;
// Character variety checks
if (/[A-Z]/.test(input)) score += 1;
if (/[a-z]/.test(input)) score += 1;
if (/\d/.test(input)) score += 1;
if (/[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]/.test(input)) score += 1;
// Bonus for mixed characters
if (/(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[!@#$%^&*])/.test(input)) score += 1;
// Determine strength
if (score <= 2) return { score, level: "Weak", color: "red" };
if (score <= 4) return { score, level: "Medium", color: "orange" };
if (score <= 6) return { score, level: "Strong", color: "blue" };
return { score, level: "Very Strong", color: "green" };
}
console.log(getPasswordStrength("abc"));
console.log(getPasswordStrength("Hello123"));
console.log(getPasswordStrength("Hello@123"));
console.log(getPasswordStrength("My$uperStr0ng!Pass2026"));
Output
{ score: 1, level: "Weak", color: "red" }
{ score: 4, level: "Medium", color: "orange" }
{ score: 6, level: "Strong", color: "blue" }
{ score: 8, level: "Very Strong", color: "green" }Example 5: Real-Time Password Validation
Example
function realtimeValidation(input) {
const checks = {
length: input.length >= 8,
uppercase: /[A-Z]/.test(input),
lowercase: /[a-z]/.test(input),
digit: /\d/.test(input),
special: /[!@#$%^&*]/.test(input),
noSpaces: !/\s/.test(input),
noRepeating: !/(.)\1{2,}/.test(input) // no 3+ repeating chars
};
const passedCount = Object.values(checks).filter(Boolean).length;
const totalChecks = Object.keys(checks).length;
const percentage = Math.round((passedCount / totalChecks) * 100);
return { checks, passedCount, totalChecks, percentage };
}
console.log(realtimeValidation("aaa"));
console.log(realtimeValidation("Hello@1World"));
console.log(realtimeValidation("Hiii@123"));
Output
{ checks: { length: false, uppercase: false, lowercase: true, digit: false, special: false, noSpaces: true, noRepeating: true }, passedCount: 3, totalChecks: 7, percentage: 43 }
{ checks: { length: true, uppercase: true, lowercase: true, digit: true, special: true, noSpaces: true, noRepeating: true }, passedCount: 7, totalChecks: 7, percentage: 100 }
{ checks: { length: true, uppercase: true, lowercase: true, digit: true, special: true, noSpaces: true, noRepeating: false }, passedCount: 6, totalChecks: 7, percentage: 86 }Example 6: Password Match Confirmation
Example
function validateWithConfirm(firstEntry, secondEntry) {
const strongRegex = /^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[!@#$%^&*]).{8,}$/;
if (!strongRegex.test(firstEntry)) {
return { valid: false, error: "Does not meet strength requirements" };
}
if (firstEntry !== secondEntry) {
return { valid: false, error: "Entries do not match" };
}
return { valid: true, error: null };
}
console.log(validateWithConfirm("Hello@123", "Hello@123"));
console.log(validateWithConfirm("Hello@123", "Hello@124"));
console.log(validateWithConfirm("weak", "weak"));
Output
{ valid: true, error: null }
{ valid: false, error: "Entries do not match" }
{ valid: false, error: "Does not meet strength requirements" }Example 7: No Common Patterns Check
Example
function hasCommonPatterns(input) {
const commonPatterns = [
/^123456/, // sequential numbers at start
/password/i, // literal "password"
/qwerty/i, // keyboard pattern
/(.)\1{3,}/, // 4+ repeating characters
/^(abc|xyz)/i, // alphabetical sequence
/^(admin|user|login)/i // common words
];
const detected = commonPatterns.filter(pattern => pattern.test(input));
return {
hasCommon: detected.length > 0,
patternsFound: detected.length
};
}
console.log(hasCommonPatterns("password123!A"));
console.log(hasCommonPatterns("qwerty@Hello1"));
console.log(hasCommonPatterns("Xy$9kL@mN2"));
console.log(hasCommonPatterns("aaaa@Hello1"));
Output
{ hasCommon: true, patternsFound: 1 }
{ hasCommon: true, patternsFound: 1 }
{ hasCommon: false, patternsFound: 0 }
{ hasCommon: true, patternsFound: 1 }Example 8: Complete Password Validator Class
Example
class PasswordValidator {
constructor(options = {}) {
this.minLength = options.minLength || 8;
this.maxLength = options.maxLength || 64;
this.requireUppercase = options.requireUppercase !== false;
this.requireLowercase = options.requireLowercase !== false;
this.requireDigit = options.requireDigit !== false;
this.requireSpecial = options.requireSpecial !== false;
}
validate(input) {
const errors = [];
if (input.length < this.minLength) {
errors.push(`Minimum ${this.minLength} characters required`);
}
if (input.length > this.maxLength) {
errors.push(`Maximum ${this.maxLength} characters allowed`);
}
if (this.requireUppercase && !/[A-Z]/.test(input)) {
errors.push("At least 1 uppercase letter required");
}
if (this.requireLowercase && !/[a-z]/.test(input)) {
errors.push("At least 1 lowercase letter required");
}
if (this.requireDigit && !/\d/.test(input)) {
errors.push("At least 1 digit required");
}
if (this.requireSpecial && !/[!@#$%^&*()_+\-=\[\]{}|;:,.<>?]/.test(input)) {
errors.push("At least 1 special character required");
}
return {
isValid: errors.length === 0,
errors,
strength: this.getStrength(input)
};
}
getStrength(input) {
let score = 0;
if (input.length >= 8) score++;
if (input.length >= 12) score++;
if (/[A-Z]/.test(input) && /[a-z]/.test(input)) score++;
if (/\d/.test(input)) score++;
if (/[^A-Za-z0-9]/.test(input)) score++;
const levels = ["Very Weak", "Weak", "Fair", "Strong", "Very Strong"];
return levels[score] || "Very Strong";
}
}
const validator = new PasswordValidator({ minLength: 10 });
console.log(validator.validate("short"));
console.log(validator.validate("Hello@World2026"));
Output
{ isValid: false, errors: ["Minimum 10 characters required", "At least 1 uppercase letter required", "At least 1 digit required", "At least 1 special character required"], strength: "Very Weak" }
{ isValid: true, errors: [], strength: "Very Strong" }Building a Password Strength Meter (Weak / Medium / Strong)
A password strength meter gives users visual feedback as they type. Here's how to build one that evaluates passwords as Weak, Medium, or Strong:
Example
function passwordStrengthMeter(input) {
// Score starts at 0
let score = 0;
const feedback = [];
// Empty input
if (!input) {
return { strength: "None", score: 0, feedback: ["Enter a password"] };
}
// Length scoring
if (input.length >= 8) {
score += 1;
} else {
feedback.push("Use at least 8 characters");
}
if (input.length >= 12) score += 1;
if (input.length >= 16) score += 1;
// Character type scoring
if (/[a-z]/.test(input)) {
score += 1;
} else {
feedback.push("Add lowercase letters");
}
if (/[A-Z]/.test(input)) {
score += 1;
} else {
feedback.push("Add uppercase letters");
}
if (/\d/.test(input)) {
score += 1;
} else {
feedback.push("Add numbers");
}
if (/[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]/.test(input)) {
score += 1;
} else {
feedback.push("Add special characters");
}
// Variety bonus
const uniqueChars = new Set(input).size;
if (uniqueChars >= 8) score += 1;
// Penalty for common patterns
if (/(.)\1{2,}/.test(input)) {
score -= 1;
feedback.push("Avoid repeating characters");
}
if (/^(password|123456|qwerty)/i.test(input)) {
score -= 2;
feedback.push("Avoid common passwords");
}
// Determine strength level
let strength, color, percentage;
if (score <= 2) {
strength = "Weak";
color = "#ff4444";
percentage = 25;
} else if (score <= 4) {
strength = "Medium";
color = "#ffaa00";
percentage = 50;
} else if (score <= 6) {
strength = "Strong";
color = "#00aa44";
percentage = 75;
} else {
strength = "Very Strong";
color = "#00cc66";
percentage = 100;
}
return { strength, score, color, percentage, feedback };
}
console.log(passwordStrengthMeter(""));
console.log(passwordStrengthMeter("hello"));
console.log(passwordStrengthMeter("Hello123"));
console.log(passwordStrengthMeter("H3llo@World!"));
console.log(passwordStrengthMeter("$uP3r_S€cure#2026!xY"));
Output
{ strength: "None", score: 0, feedback: ["Enter a password"] }
{ strength: "Weak", score: 2, color: "#ff4444", percentage: 25, feedback: ["Use at least 8 characters", "Add uppercase letters", "Add numbers", "Add special characters"] }
{ strength: "Medium", score: 4, color: "#ffaa00", percentage: 50, feedback: ["Add special characters"] }
{ strength: "Strong", score: 6, color: "#00aa44", percentage: 75, feedback: [] }
{ strength: "Very Strong", score: 8, color: "#00cc66", percentage: 100, feedback: [] }Integrating the Strength Meter with DOM (Browser Example)
Example
// HTML: <input id="passwordInput" type="password">
// <div id="strengthBar"></div>
// <span id="strengthLabel"></span>
function setupPasswordMeter() {
const input = document.getElementById("passwordInput");
const bar = document.getElementById("strengthBar");
const label = document.getElementById("strengthLabel");
input.addEventListener("input", function () {
const result = passwordStrengthMeter(this.value);
bar.style.width = result.percentage + "%";
bar.style.backgroundColor = result.color;
label.textContent = result.strength;
label.style.color = result.color;
});
}
// Simulating the meter output:
const testInputs = ["abc", "Hello1", "Secure@99", "Ultra$ecure#2026!"];
for (let i = 0; i < testInputs.length; i++) {
const val = testInputs[i];
const result = passwordStrengthMeter(val);
console.log(`"${val}" => ${result.strength} (${result.percentage}%)`);
}
Output
"abc" => Weak (25%) "Hello1" => Medium (50%) "Secure@99" => Strong (75%) "Ultra$ecure#2026!" => Very Strong (100%)
🚫 Common Mistakes
Mistake 1: Forgetting Anchors ^ and $
Example
// ❌ WRONG — matches substring, not entire password
const weakRegex = /(?=.*[A-Z])(?=.*\d).{8,}/;
console.log(weakRegex.test("short A1 but this text is long")); // true (matches substring!)
// ✅ CORRECT — anchors ensure entire string is tested
const strongRegex = /^(?=.*[A-Z])(?=.*\d).{8,}$/;
console.log(strongRegex.test("Hello123")); // true — full string passes
Output
true true
Mistake 2: Using match() Instead of test() for Boolean Checks
Example
// ❌ WRONG — match() returns array or null, wasteful for validation
const result = "Hello@123".match(/^(?=.*[A-Z])(?=.*\d).{8,}$/);
console.log(result); // Array — unnecessary overhead
// ✅ CORRECT — test() returns boolean, more efficient
const isValid = /^(?=.*[A-Z])(?=.*\d).{8,}$/.test("Hello@123");
console.log(isValid); // clean boolean
Output
["Hello@123"] true
Mistake 3: Not Escaping Special Characters in Character Class
Example
// ❌ WRONG — unescaped hyphen in middle creates a range
const buggy = /[!@#$%^&*()-+]/; // '-' between ')' and '+' creates range
console.log(buggy.test("*")); // may produce unexpected results
// ✅ CORRECT — escape or place hyphen at start/end
const correct = /[!@#$%^&*()\-+]/;
console.log(correct.test("*"));
console.log(correct.test("-"));
Output
true true true
Mistake 4: Only Validating on Client Side
Example
// ❌ WRONG — relying only on frontend validation
function clientOnlyValidation(input) {
// Attackers can bypass this by disabling JavaScript!
return /^(?=.*[A-Z])(?=.*\d).{8,}$/.test(input);
}
// ✅ CORRECT — validate on both client AND server
function secureValidation(input) {
// Client-side for UX feedback
const clientValid = /^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[!@#$%^&*]).{8,}$/.test(input);
// Always send to server for final validation
// Server also checks: not in breach database, not a common password, etc.
return { clientValid, note: "Server validation also required" };
}
console.log(secureValidation("Hello@123"));
console.log(secureValidation("weak"));
Output
{ clientValid: true, note: "Server validation also required" }
{ clientValid: false, note: "Server validation also required" }Mistake 5: Not Handling Unicode Characters
Example
// ❌ WRONG — [A-Z] only matches ASCII uppercase
const asciiOnly = /[A-Z]/;
console.log(asciiOnly.test("Ñ")); // false — misses accented chars
console.log(asciiOnly.test("Ü")); // false
// ✅ CORRECT — use Unicode property escapes for international support
const unicodeUpper = /\p{Lu}/u; // Unicode uppercase letter
console.log(unicodeUpper.test("Ñ")); // true
console.log(unicodeUpper.test("Ü")); // true
console.log(unicodeUpper.test("A")); // true
Output
false false true true true
Mistake 6: Setting Maximum Password Length Too Short
js example
// ❌ WRONG — limiting to 16 chars blocks passphrases
const tooRestrictive = /^.{8,16}$/;
console.log(tooRestrictive.test("MyVeryLongAndSecurePassphrase!1")); // rejected!
// ✅ CORRECT — allow long passwords (up to 64 or 128)
const reasonable = /^.{8,128}$/;
console.log(reasonable.test("MyVeryLongAndSecurePassphrase!1")); // acceptedOutput
false true
🎯 Key Takeaways
- Lookaheads
(?=...)are the core tool for password validation — they check conditions without consuming characters, allowing multiple checks from the same position.
- Always use anchors
^and$to ensure the entire password string is validated, not just a matching substring.
- Break complex regex into individual rules — this makes code more readable, debuggable, and gives better user feedback on which requirements are not met.
- Use
test()notmatch()when you only need a boolean result — it's faster and more semantically correct.
- Client-side validation is for UX only — always re-validate on the server. JavaScript can be disabled or bypassed by attackers.
- The combined regex pattern
^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[!@#$%^&*]).{8,}$checks all requirements in one expression.
- Password strength meters should be multi-factor — consider length, character variety, uniqueness, and absence of common patterns.
- Don't set maximum length too short — allow at least 64 characters to support passphrases which are more secure than complex short passwords.
- Consider Unicode — if your app supports international users,
\p{Lu}and\p{Ll}with theuflag handle non-ASCII letters correctly.
- Avoid common pattern pitfalls — check for repeated characters, sequential numbers, keyboard patterns, and dictionary words alongside regex requirements.
❓ Interview Questions
Q1: Explain how lookaheads work in password validation regex.
Answer: Lookaheads (?=...) are zero-width assertions — they check if a pattern exists ahead of the current position without consuming any characters. In password validation, multiple lookaheads are placed at the start (^) to verify different requirements:
Example
/^(?=.*[A-Z])(?=.*\d).{8,}$/
Each lookahead starts scanning from position 0. (?=.*[A-Z]) checks "does at least one uppercase exist anywhere?" and (?=.*\d) checks "does at least one digit exist anywhere?" After all lookaheads pass, .{8,} actually matches and consumes the characters.
Q2: Write a regex that validates a password with: 8-20 chars, at least 2 uppercase, 1 digit, 1 special character, and no spaces.
Answer:
Example
const regex = /^(?=(?:.*[A-Z]){2})(?=.*\d)(?=.*[!@#$%^&*])(?!.*\s).{8,20}$/;
console.log(regex.test("HeLlo@123")); // true — 2 uppercase (H, L)
console.log(regex.test("hello@123")); // false — no uppercase
console.log(regex.test("HE llo@123")); // false — has space
console.log(regex.test("HEllo@123456789012345")); // false — too long (21 chars)
Output
true false false false
The key technique is (?:.*[A-Z]){2} which requires the uppercase pattern to match at least 2 times, and (?!.*\s) is a negative lookahead that rejects spaces.
Q3: What is the difference between (?=.*[A-Z]) and [A-Z] in password regex?
Answer: [A-Z] matches a single uppercase letter at the current position and consumes it. (?=.*[A-Z]) is a lookahead that checks if an uppercase letter exists *anywhere* in the remaining string without consuming characters.
In password validation, we need (?=.*[A-Z]) because:
- The uppercase letter can be at any position in the password
- We need to check multiple conditions from the same starting position
- Using
[A-Z]alone would only match at a specific position
Q4: How would you implement a password blacklist check using regex?
Answer:
Example
function checkAgainstBlacklist(input) {
const blacklist = ["password", "123456", "qwerty", "admin", "letmein"];
const blacklistRegex = new RegExp(blacklist.join("|"), "i");
const containsBlacklisted = blacklistRegex.test(input);
const isExactMatch = blacklist.includes(input.toLowerCase());
return {
containsBlacklistedWord: containsBlacklisted,
isExactBlacklistedEntry: isExactMatch,
allowed: !isExactMatch && !containsBlacklisted
};
}
console.log(checkAgainstBlacklist("MyPassword@1"));
console.log(checkAgainstBlacklist("Str0ng!#Key"));
Output
{ containsBlacklistedWord: true, isExactBlacklistedEntry: false, allowed: false }
{ containsBlacklistedWord: false, isExactBlacklistedEntry: false, allowed: true }Q5: Why should you NOT rely solely on regex for password security validation?
Answer: Regex can only check structural patterns (length, character types). It cannot:
- Check if the password appears in breach databases (e.g., Have I Been Pwned)
- Detect passwords derived from the user's personal info (name, email, birthday)
- Calculate true entropy or randomness
- Enforce rate limiting against brute force attacks
- Hash and store passwords securely
A complete password security solution needs server-side validation, bcrypt/argon2 hashing, breach database checks, rate limiting, and account lockout policies — regex handles only the first layer (format validation).
📝 FAQ
Q1: What is the best regex for strong password validation in JavaScript?
The most commonly used strong password regex is:
Example
/^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[!@#$%^&*]).{8,}$/
This requires at least 8 characters with at least one uppercase, one lowercase, one digit, and one special character. Adjust the .{8,} portion for different minimum lengths or add {8,64} for a maximum length cap.
Q2: How do I show real-time password validation feedback to users?
Use the input event listener on the password field and test each regex rule individually. Display pass/fail indicators (checkmark or cross) next to each requirement. This gives users immediate feedback as they type, improving form completion rates by up to 22%.
Q3: Should I use one combined regex or separate regex patterns for password validation?
Use separate patterns for user-facing validation (so you can show which specific requirement failed) and the combined regex for quick server-side boolean checks. The separate approach is more maintainable and provides better UX feedback.
Q4: How do I validate that the password and confirm-password fields match?
Use the strict equality operator (===) to compare both field values directly. No regex is needed for this check. Always validate the strength requirements first, then verify the two entries match. This gives users clear, specific error messages for each issue.
Q5: Can regex detect if a password is a dictionary word?
Regex alone cannot efficiently check against a dictionary. For dictionary-word detection, use a server-side lookup against a word list or a library like zxcvbn which estimates password strength using pattern matching, dictionary checks, and spatial keyboard patterns — far beyond what regex can achieve.
Exam Focus
Revise definitions, diagrams, examples, and short-answer points for JavaScript Password Validation with Regex — Strength Checker & Patterns 2026.
Interview Use
Prepare one clear explanation, one practical example, and one common mistake for this JavaScript Master Course topic.
Search Terms
javascript-complete-guide, javascript master course, javascript, complete, guide, regex, password, validation
Related JavaScript Master Course Topics
Continue learning this concept
RegexJavaScript Regex Email Validation – Pattern, Edge Cases & Best PracticesBuild a JavaScript regex email validator with step-by-step pattern breakdown, valid/invalid edge cases, HTML5 comparison, and real-world form validation function with interview Q&A.RegexJavaScript Number Validation with Regex — Complete Patterns & Examples 2026Master number validation in JavaScript using regex patterns. Learn integer, decimal, phone, currency validation with real examples and outputs.RegexJavaScript URL Validation with Regex — Complete Patterns & Examples 2026Master URL validation in JavaScript using regex patterns. Learn protocols, domains, paths, query strings with practical code examples.RegexJavaScript Username Validation with Regex — Patterns & Form Examples 2026Learn JavaScript username validation using regex patterns. Build real-time form validation with alphanumeric rules, length checks & availability simulation.RegexJavaScript Regex Character Classes – [abc], [^abc], Ranges & ShortcutsMaster JavaScript regex character classes: square bracket syntax, negated classes, ranges [a-z], shorthand classes \\d \\w \\s, and real-world pattern examples with interview Q&A.RegexJavaScript Regex Flags – g, i, m, s, u, y Flags Explained with ExamplesMaster all JavaScript regex flags: g (global), i (case-insensitive), m (multiline), s (dotAll), u (unicode), y (sticky). With visual examples, common mistakes, and interview Q&A.