3

I am a newbie to RegEx and have done a lot of searching already but have not found anything specific.

I am writing a regular expression that validates a password string. The acceptable string must have at least 3 of 4 character types: digits, lowercase, uppercase, special char[<+$*)], but must not include another special set of characters(|;{}).

I got an idea regarding the inclusion(that is if it is the right way).

It looks like this:

^((a-z | A-Z |\d)(a-z|A-Z|[<+$*])(a-z|[<+$*]|\d)(A-Z|[<+$*]|\d)).*$

How do I ensure that user does not enter special chars(|;{}) This is what I tried with the exclusion string:

^(?:(?![|;{}]).)*$

I have tried a bit of tricks to combine the two in a single regEx but can't get it to work.

Any input on how to do this right?

5
  • 4
    It would be simpler to check the length, then presence of each character type separately then check for the absence of the specific chars. If you do that in a single regex, it'll be more complicated. In any case, don't forget to put the tag of the language you're using in your question as well.
    – Jerry
    Commented Sep 4, 2013 at 18:54
  • What language are you programming in? Commented Sep 4, 2013 at 20:04
  • 1
    Why would you disallow characters in passwords?
    – Cogwheel
    Commented Sep 6, 2013 at 0:04
  • Boost has the greatest regex library there is bar none. The nice thing about the library is you don't need it, just add the boost include paths and the regex sourse files to your project. There aren't that many. This cuts out the middle man so you can have many different project configurations and settings without worrying about libraries.
    – user557597
    Commented Sep 6, 2013 at 0:20
  • +1 to get you some capabilities.
    – user557597
    Commented Sep 6, 2013 at 0:25

3 Answers 3

9

Don't try to do it all in one regex. Make two different checks.

Say you're working in Perl (since you didn't specify language):

$valid_pw =
    ( $pw =~ /^((a-z | A-Z |\d)(a-z|A-Z|[<+$*])(a-z|[<+$*]|\d)(A-Z|[<+$*]|\d)).*$/ ) &&
    ( $pw !~ /\|;{}/ );

You're saying "If the PW matches all the inclusion rules, and the PW does NOT match any of the excluded characters, then the password is valid."

Look how much clearer that is than something like @Jerry's response above of:

^(?![^a-zA-Z]*$|[^a-z0-9]*$|[^a-z<+$*]*$|[^A-Z0-9]*$|[^A-Z<+$*]*$|[^0-9<+$*]*$|.*[|;{}]).*$

I don't doubt that Jerry's version works, but which one do you want to maintain?

In fact, you could break it down even further and be extremely clear:

my $cases_matched = 0;
$cases_matched++ if ( $pw =~ /\d/ );       # digits
$cases_matched++ if ( $pw =~ /[a-z]/ );    # lowercase
$cases_matched++ if ( $pw =~ /[A-Z]/ );    # uppercase
$cases_matched++ if ( $pw =~ /<\+\$\*/ );  # special characters

my $is_valid = ($cases_matched >= 3) && ($pw !~ /\|;{}/); # At least 3, and none forbidden.

Sure, that takes up 6 lines instead of one, but in a year when you go back and have to add a new rule, or figure out what the code does, you'll be glad you wrote it that way.

Just because you can do it in one regex doesn't mean you should.

3
  • There is a professional regex formatting program out there that makes maintinance a breeze. Loaded with options, but cost some bucks. I use it all the time. www.RegexFormat.com
    – user557597
    Commented Sep 4, 2013 at 21:14
  • 3
    I can't imagine spending $50 to buy a program (that I can't run on my non-Windows machine) that would do my job of formatting my code for me. Regexes are just code. Commented Sep 4, 2013 at 21:33
  • Thats understandable. Really its an aid to the user, not a replacement for the user. I'm addicted to it. I'm tired of straining my eyes looking at long complex expressions by others. It does a lot more than formatting. I don't feel threatened by it at all. Maybe a little pissed by the cost, but I got my money's worth so far.
    – user557597
    Commented Sep 6, 2013 at 0:06
2

Your current regex will not work for enforcing the at least 3 of 4 requirement. Using regex for this gets pretty complicated, but in my opinion the best way to do this is to use a negative lookahead that contains all of the failure cases, so that the entire match will fail if any of the negative cases are met. In this case the "at least 3 of 4" requirement can also be described as "fail if any 2 groups are not found". This also makes it very easy to add the final requirement to ensure that no characters from [|;{}] are found:

^               # beginning of string anchor
(?!             # fail if
   [^a-zA-Z]*$     # no [a-z] or [A-Z] anywhere
     |             # OR
   [^a-z0-9]*$     # no [a-z] or [0-9] anywhere
     |             # OR
   [^a-z<+$*]*$    # no [a-z] or [<+$*] anywhere
     |             # OR
   [^A-Z0-9]*$     # no [A-Z] or [0-9] anywhere
     |             # OR
   [^A-Z<+$*]*$    # no [A-Z] or [<+$*] anywhere
     |             # OR
   [^0-9<+$*]*$    # no [0-9] or [<+$*] anywhere
     |             # OR
   .*[|;{}]        # a character from [|;{}] exists
)
.*$             # made it past the negative cases, match the entire string

Here it is as a single line:

^(?![^a-zA-Z]*$|[^a-z0-9]*$|[^a-z<+$*]*$|[^A-Z0-9]*$|[^A-Z<+$*]*$|[^0-9<+$*]*$|.*[|;{}]).*$

Example: http://rubular.com/r/4YV6Aj0vqh

1
  • Thanks for your responses. These are exactly what I am looking for. I have done some initial on F.J's method and it is working so far but will go through extensive testing before finalizing. Andy is definitely right about the long term and the importance of clarity. My current requirements only call for the use of regex but again since many other unrelated options and plenty of testing are pending I will just keep my options open. Thanks! Commented Sep 5, 2013 at 21:47
1

This is for accepting only the characters you mentioned:

^(?:(?=.*[0-9])(?=.*[a-z])(?=.*[<+$*)])|(?=.*[a-z])(?=.*[<+$*)])(?=.*[A-Z])|(?=.*[0-9])(?=.*[A-Z])(?=.*[<+$*)])|(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z]))[0-9A-Za-z<+$*)]+$

And this one for all the characters you mentioned, and any special characters except |;{}.

^(?:(?=.*[0-9])(?=.*[a-z])(?=.*[<+$*)])|(?=.*[a-z])(?=.*[<+$*)])(?=.*[A-Z])|(?=.*[0-9])(?=.*[A-Z])(?=.*[<+$*)])|(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z]))(?!.*[|;{}].*$).+$

(One difference is that the first regex doesn't accept the special char @ but the second does).

I have also used + since passwords logically can't be 0 width.

However, it's quite long, longer than F.J's regex, oh well. That's because I'm using positive lookaheads, which require more checks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.