EasySecurity4 min read

Basic Password Regex

Validates a simple password policy: 6-20 alphanumeric characters containing at least one letter and one digit, with no special-character or mixed-case requirements.

#password#security#validation#authentication#forms

Practice this Regex Pattern

Put your regex skills to the test! Try writing this pattern in our interactive challenges workspace.

Start Challenge →

Regex Pattern

^(?=.*[A-Za-z])(?=.*\d)[A-Za-z0-9]{6,20}$

Pattern Breakdown

Hover over a token to see what it does.

^(?=.*[A-Za-z])(?=.*\d)[A-Za-z0-9]{6,20}$
TokenMeaning
^Anchors the checks to the start of the string
(?=.*[A-Za-z])Positive lookahead requiring at least one letter (upper or lower case) anywhere in the string
(?=.*\d)Positive lookahead requiring at least one digit anywhere in the string
[A-Za-z0-9]{6,20}The actual match: 6 to 20 characters, each a letter or digit
$Anchors the match to the end of the string

Detailed Explanation

What it does

This pattern enforces a lightweight password policy: the password must be 6-20 characters long, made up only of letters and digits, and contain at least one letter and one digit. Unlike a strong-password policy, it does not require mixed case or special characters.

Why it works

The two lookaheads independently confirm a letter and a digit exist somewhere in the string without consuming any characters, so both can be checked from the same starting position. The final `[A-Za-z0-9]{6,20}` then consumes and bounds the whole string, enforcing both the length limits and the letters-and-digits-only character whitelist.

Common use cases

  • Low-friction sign-up forms for internal tools or low-risk accounts where usability matters more than strict complexity
  • Quick prototype or MVP account systems before a full password policy is designed
  • Validating PINs or simple access codes that mix letters and numbers
  • Providing a gentler alternative to strict policies for products with a broad, non-technical user base

Edge cases

  • A password like 'abcdef' fails since it has no digit, even though it meets the length requirement
  • Special characters like '!' or '_' are rejected outright since the character class only allows letters and digits
  • A 20-character password is the longest accepted; longer input, even if otherwise valid, is rejected
  • Passwords like 'aaaaa1' pass despite being highly predictable, since this policy checks composition, not entropy

Limitations

  • Provides much weaker security guarantees than a strong-password policy with case, length, and symbol requirements
  • Does not check against common password dictionaries or breached-password lists
  • Does not measure actual entropy or predictability of the chosen password
  • Excludes legitimate special characters some users may want to include, since only letters and digits are allowed

Interactive Tester

Edit the pattern or text below — matching runs live in your browser.

//
Open in Playground →
abc123 Password1 Passw0rd
3 matches

Test Cases

Editable — add your own inputs to see if they pass.

InputExpectedResult
Pass
Pass
Pass
Pass
Pass
Pass
Pass
Pass

Language Variants

Production-ready examples in 12 languages.

const basicPasswordPattern = /^(?=.*[A-Za-z])(?=.*\d)[A-Za-z0-9]{6,20}$/;

function isBasicValidPassword(value) {
  return basicPasswordPattern.test(value);
}

console.log(isBasicValidPassword("abc123")); // true

Common Mistakes

Using this basic policy for high-value accounts (banking, admin) where stronger complexity is warranted

Fix: Reserve this lighter policy for low-risk contexts and use a stricter pattern like password-strong for sensitive accounts

Assuming Go's or Rust's standard regex engines support lookahead the same way JavaScript does

Fix: RE2-based engines (Go's regexp, Rust's regex crate) don't support lookahead; check letter and digit presence with separate simple regexes instead

Forgetting that spaces and special characters are rejected outright by the [A-Za-z0-9] whitelist

Fix: Widen the character class if you want to allow passphrases with spaces or symbols

Performance Notes

  • Two lightweight lookaheads plus a bounded final match keep this pattern fast even on longer passwords
  • Because lookaheads are zero-width, they don't interact with the final match's backtracking
  • The bounded {6,20} quantifier on a simple character class carries no catastrophic backtracking risk

Browser Compatibility

EngineSupportedNotes
ChromeYesLookahead assertions are supported in all modern JavaScript engines.
FirefoxYes—
SafariYes—
EdgeYes—
Node.jsYes—

Work with this pattern

Take this expression further — test it against your own data, adapt it in the builder, or read up on the syntax behind it.

Regex Tester

Test a regular expression against sample text and see every match highlighted live.

Regex Generator

Build a pattern by clicking blocks — no syntax memorisation required.

Regular Expressions Guide

What regex is, how the syntax works, and the mistakes that trip people up.

Regex Cheat Sheet

Every token, quantifier, and assertion on one printable page.

Python Regex Guide

The re module end to end — search, match, findall, groups, and substitution.

Regex Pattern Library

100+ ready-to-use patterns for email, URLs, dates, IPs, and more.