35

My client has requested that passwords on their system must following a specific set of validation rules, and I'm having great difficulty coming up with a "nice" regular expression.

The rules I have been given are...

  • Minimum of 8 character
  • Allow any character
  • Must have at least one instance from three of the four following character types...
    1. Upper case character
    2. Lower case character
    3. Numeric digit
    4. "Special Character"

When I pressed more, "Special Characters" are literally everything else (including spaces).

I can easily check for at least one instance for all four, using the following...

^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?\d)(?=.*?[^a-zA-Z0-9]).{8,}$

The following works, but it's horrible and messy...

^((?=.*?[A-Z])(?=.*?[a-z])(?=.*?\d)|(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[^a-zA-Z0-9])|(?=.*?[A-Z])(?=.*?\d)(?=.*?[^a-zA-Z0-9])|(?=.*?[a-z])(?=.*?\d)(?=.*?[^a-zA-Z0-9])).{8,}$

So you don't have to work it out yourself, the above is checking for (1,2,3|1,2,4|1,3,4|2,3,4) which are the 4 possible combinations of the 4 groups (where the number relates to the "types" in the set of rules).

Is there a "nicer", cleaner or easier way of doing this?

(Please note, this is going to be used in an <asp:RegularExpressionValidator> control in an ASP.NET website, so therefore needs to be a valid regex for both .NET and javascript.)

7
  • I don't think there is a "nice" one shot pattern to do this. The best way is to set a counter variable to zero and increment it with four separate tests. You can perform these tests with regex or with build in functions if available (I don't know asp) Mar 5, 2014 at 17:57
  • I see what you're saying @Casimiret, but that would require multiple regexs and extra custom processing to work it out. Unfortunately this needs to be a single pattern, as it's a "configuration" that will drive the <asp:RegularExpressionValidator> control in several different parts of the website.
    – freefaller
    Mar 5, 2014 at 18:00
  • If you have the possibility to avoid, for this type of data, the RegularExpressionValidator and find an other way to do it, do not hesitate. Keep in mind that a simple (?=.*[a-z]) is bad in term of performance, multiplicate it by twelve... Mar 5, 2014 at 18:10
  • The best way is to use <asp:CustomValidator> and write your own function. Mar 5, 2014 at 18:19
  • 1
    This should be the correct answer: stackoverflow.com/a/5951154/1497565
    – Mukus
    Apr 27, 2019 at 23:29

4 Answers 4

28

It's not much of a better solution, but you can reduce [^a-zA-Z0-9] to [\W_], since a word character is all letters, digits and the underscore character. I don't think you can avoid the alternation when trying to do this in a single regex. I think you have pretty much have the best solution.

One slight optimization is that \d*[a-z]\w_*|\d*[A-Z]\w_* ~> \d*[a-zA-Z]\w_*, so I could remove one of the alternation sets. If you only allowed 3 out of 4 this wouldn't work, but since \d*[A-Z][a-z]\w_* was implicitly allowed it works.

(?=.{8,})((?=.*\d)(?=.*[a-z])(?=.*[A-Z])|(?=.*\d)(?=.*[a-zA-Z])(?=.*[\W_])|(?=.*[a-z])(?=.*[A-Z])(?=.*[\W_])).*

Extended version:

(?=.{8,})(
  (?=.*\d)(?=.*[a-z])(?=.*[A-Z])|
  (?=.*\d)(?=.*[a-zA-Z])(?=.*[\W_])|
  (?=.*[a-z])(?=.*[A-Z])(?=.*[\W_])
).*

Because of the fourth condition specified by the OP, this regular expression will match even unprintable characters such as new lines. If this is unacceptable then modify the set that contains \W to allow for more specific set of special characters.

12
  • 1
    Thanks for that @Daniel. I do like the [\W_], although I personally don't think it's a readable as [^a-zA-Z0-9]
    – freefaller
    Mar 5, 2014 at 18:16
  • I have removed the part about matching "abcdefg1" from the above comment - my regex tester defaults the i switch to on. Switching i off and your expression work perfectly
    – freefaller
    Mar 5, 2014 at 18:18
  • Interesting idea... but why doesn't it work in my preferred checker? regextester.com
    – freefaller
    Mar 14, 2014 at 17:00
  • @freefaller I removed that idea, the grouping didn't work correctly with the look aheads. However I found a d'oh! simplification that makes the regex much easier on the eyes. Mar 15, 2014 at 13:18
  • @DanielGimenez I have to keep some special characters only so can you please help me. I have to keep [@#$%^*()!&=\s] this only. Rest conditions are same. Feb 2, 2017 at 9:41
2

I'd like to improve the accepted solution with this one

^(?=.{8,})(
    (?=.*[^a-zA-Z\s])(?=.*[a-z])(?=.*[A-Z])|
    (?=.*[^a-zA-Z0-9\s])(?=.*\d)(?=.*[a-zA-Z])
).*$
0
0

The above Regex worked well for most scenarios except for strings such as "AAAAAA1$", "$$$$$$1a" This could be an issue only in iOS ( Objective C and Swift) that the regex "\d" has issues The following fix worked in iOS, i.e changing to [0-9] for digits

^((?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])|(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[^a-zA-Z0-9])|(?=.*?[A-Z])(?=.*?[0-9])(?=.*?[^a-zA-Z0-9])|(?=.*?[a-z])(?=.*?[0-9])(?=.*?[^a-zA-Z0-9])).{8,}$
0

Password must meet at least 3 out of the following 4 complexity rules,

[at least 1 uppercase character (A-Z) at least 1 lowercase character (a-z) at least 1 digit (0-9) at least 1 special character — do not forget to treat space as special characters too]

at least 10 characters

at most 128 characters

not more than 2 identical characters in a row (e.g., 111 not allowed)

'^(?!.(.)\1{2}) ((?=.[a-z])(?=.[A-Z])(?=.[0-9])|(?=.[a-z])(?=.[A-Z])(?=.[^a-zA-Z0-9])|(?=.[A-Z])(?=.[0-9])(?=.[^a-zA-Z0-9])|(?=.[a-z])(?=.[0-9])(?=.*[^a-zA-Z0-9])).{10,127}$'

(?!.*(.)\1{2})

(?=.[a-z])(?=.[A-Z])(?=.*[0-9])

(?=.[a-z])(?=.[A-Z])(?=.*[^a-zA-Z0-9])

(?=.[A-Z])(?=.[0-9])(?=.*[^a-zA-Z0-9])

(?=.[a-z])(?=.[0-9])(?=.*[^a-zA-Z0-9])

.{10,127}

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.