Breaking down ^(?=.*[A-Z])(?=.*\d)[A-Za-z\d]{8,}$

Piece by piece

How it works together

Both lookaheads run from position 0 and don't move the cursor, so they act as independent "must contain" checks. Then [A-Za-z\d]{8,} consumes the whole string and enforces the length and character set.

In effect, this is a simple password rule: at least 8 characters, only letters and digits, with at least one uppercase letter and at least one digit. (Lowercase letters are allowed but not required.)

Strings it matches

1. Password1: 9 characters, has uppercase P and digit 1, all alphanumeric.
2. 12345678A: 9 characters, has digit(s) and uppercase A. (Order doesn't matter.)

Strings it rejects

1. password1: has a digit but no uppercase letter, so the first lookahead fails.
2. Pass word1 (or Passw0rd!): contains a space (or !), which isn't in [A-Za-z\d], so the character class fails to reach $.

Other rejections: Pass1 (too short, only 5 characters) and PasswordOnly (no digit).

This regular expression is commonly used for password validation.

Overall, it matches any string that is at least 8 characters long, contains only letters and numbers, and includes at least one uppercase letter and at least one number.

Here is the piece-by-piece breakdown:

Piece-by-Piece Explanation

• ^
  • Start of the string: This asserts that the match must start at the very beginning of the string. It prevents partial matches (e.g., matching a valid part of an otherwise invalid string).
• (?=.*[A-Z])
  • Positive Lookahead for an Uppercase Letter:
  • (?=...) is a "positive lookahead." It checks to see if a pattern exists ahead in the string without actually moving the regex engine forward.
  • .* matches any character (except a newline) zero or more times.
  • [A-Z] matches a single uppercase letter from A to Z.
  • Meaning: "Look ahead from the start and make sure there is at least one uppercase letter somewhere in the string."
• (?=.*\d)
  • Positive Lookahead for a Digit:
  • Similar to the previous piece, this looks ahead from the very beginning of the string.
  • \d matches any digit (equivalent to [0-9]).
  • Meaning: "Look ahead from the start and make sure there is at least one number somewhere in the string."
• [A-Za-z\d]{8,}
  • The Character Set and Length: Now that the lookaheads have confirmed the requirements exist, this part actually consumes/matches the characters.
  • [A-Za-z\d] is a character set that allows uppercase letters (A-Z), lowercase letters (a-z), and digits (\d). Note: Because punctuation, spaces, and symbols are not in these brackets, they are not allowed.
  • {8,} is a quantifier meaning "8 or more times."
  • Meaning: "The string must consist of at least 8 alphanumeric characters."
• $
  • End of the string: This asserts that the match must end at the very end of the string. Combined with the ^ at the beginning, this ensures the entire string adheres to the rules.

Examples

Two Strings it Matches:

1. Password123 (11 characters long, contains only letters and numbers, has an uppercase 'P' and digits '123').
2. 9999999A (Exactly 8 characters long, contains a digit and an uppercase 'A'. Note: The regex does not actually require lowercase letters, it just allows them).

Two Strings it Rejects:

1. password123 (Rejected because it is missing an uppercase letter, failing the (?=.*[A-Z]) check).
2. Pass123! (Rejected because of the !. Even though it has 8 characters, an uppercase letter, and a digit, the [A-Za-z\d] section does not allow special characters). (Bonus rejection: Pass12 would be rejected because it is only 6 characters long).

This regular expression:

^(?=.*[A-Z])(?=.*\d)[A-Za-z\d]{8,}$

matches strings that look like a simple password with these rules:

• At least 8 characters long
• Contains at least one uppercase letter
• Contains at least one digit
• Contains only letters and digits
• No spaces or special characters

Piece by piece:

^

Start of the string.

(?=.*[A-Z])

Positive lookahead requiring at least one uppercase letter A through Z somewhere in the string.

(?=.*\d)

Positive lookahead requiring at least one digit somewhere in the string.

[A-Za-z\d]{8,}

Matches 8 or more characters, where each character must be:

• A-Z uppercase letter
• a-z lowercase letter
• \d digit

$

End of the string.

So the whole string must satisfy the rules from beginning to end.

Examples it matches:

Password1
ABCdef123

Examples it rejects:

password1

Rejected because it has no uppercase letter.

Pass1!

Rejected because it is shorter than 8 characters and contains a special character !.

This regex matches strings that are at least 8 characters long, contain only letters and digits, and include at least one uppercase letter and at least one digit.

Piece by piece:

• ^ — start of the string.
• (?=.*[A-Z]) — lookahead (not consumed): somewhere ahead there is an uppercase A–Z.
• (?=.*\d) — lookahead: somewhere ahead there is a digit.
• [A-Za-z\d]{8,} — the actual match: 8 or more characters, each a letter or digit (no spaces or symbols).
• $ — end of the string.

Both lookaheads must succeed, and the whole string must be alphanumeric and at least 8 characters.

Matches: Password1, Abcdef12

Rejects: password1 (no uppercase), Password! (has a symbol; also no digit)