[SOLVED] password validation with regex

freeroute · 09-20-2017, 10:54 AM

Conditions:

1. The password must have between six and thirteen word characters \w
2. It must include at least one lowercase character [a-z]
3. It must include at least three uppercase characters [A-Z]
4. It must include at least one digit \d

I tried this command:

Code:

^(?=.*[a-z])(?=.*[0-9])(?=.*[A-Z]{3,})\w{6,13}$

and this is working partially, but only if uppercase chars repeated...

Match:
PASSWORD32pa3
passwrd32ABNA
password34AAA
passord345AAA
passw2ordAAAA

Not match:
passwo3ABsSA
PAeQsaaa23

Why does not match "passwo3ABsSA"?

I tested it with regextester.

rtmistler · 09-20-2017, 12:22 PM

It is matching 3 uppercase letters in a group, or in sequence. In that test case, it happens to be the one test case where you do not have 3 or more uppercase letters in sequence.

Try:

Code:

(?=(.*?[A-Z]){3})

freeroute · 09-20-2017, 12:31 PM

Thanks.

sundialsvcs · 09-20-2017, 08:00 PM

Personally, I think that such policies are misguided, for three reasons:

If the user didn't tape his password on the underside of the keyboard, look underneath his coffee cup.
A vast number of possibilities are excluded from consideration.
At the end of the day, every human password is "pronounceable."

The only way to strengthen login is to abandon the use of "pure passwords" and to adopt two-factor authentication. Give everyone a random-number fob and require them to type in the number that they presently see displayed upon their fob. Or, give them a plastic card that they must swipe while entering a PIN.

freeroute · 09-22-2017, 03:29 AM

Okay. I am beginner, just learning regex. I would like to find solutions simple password validation with regular expression only.
(Also I am searching on-line lessons for regex.)

But anyway thank you for your advice.

pan64 · 09-22-2017, 04:40 AM

hard to specify such things using regexp: at least three uppercase characters - but not consecutive

Code:

(?=(.*[A-Z]){3,})

will work better