Why is this regex allowing a caret?

http://regexr.com/3ars8

^(?=.*[0-9])(?=.*[A-z])[0-9A-z-]{17}$

Should match "17 alphanumeric chars, hyphens allowed too, must include at least one letter and at least one number"

It'll correctly match:

ABCDF31U100027743

and correctly decline to match:

AB$DF31U100027743

(and almost any other non-alphanumeric char)

but will apparently allow:

AB^DF31U100027743

Because your character class [A-z] matches this symbol.

[A-z] matches [, \, ], ^, _, `, and the English letters.

Actually, it is a common mistake. You should use [a-zA-Z] instead to only allow English letters.

Here is a visualization from Expresso, showing what the range [A-z] actually covers:

So, this regex (with i option) won't capture your string.

^(?=.*[0-9])(?=.*[a-z])[0-9a-z-]{17}$

In my opinion, it is always safer to use Ignorecase option to avoid such an issue and shorten the regex.

regex uses ASCII printable characters from the space to the tilde range.

Whenever we use [A-z] token it matches the following table highlighted characters. If we use [ -~] token it matches starting from SPACE to tilde.

You're allowing A-z (capital 'A' through lower 'z'). You don't say what regex package you're using, but it's not necessarily clear that A-Z and a-z are contiguous; there could be other characters in between. Try this instead:

^(?=.*[0-9])(?=.*[A-Za-z])[0-9A-Za-z-]{17}$

It seems to meet your criteria for me in regexpal.