Regex to validate a password

Question

Possible Duplicate:
Password validation regex

between 8 and 16 characters, with at least 1 character from each of the 3 character classes -alphabetic upper and lower case, numeric, symbols.

I have this code, but it doesn't work, when I write more than 16 characters, gives it as valid, but it should not; the it should to work ok with 3 character classes, but it works with 4, where's my mistake??

http://jsbin.com/ugesow/1/edit

<label for="pass">Enter Pass: </label>
<input type="text" id="pass" onkeyup="validate()">

Script

function validate() {
    valor = document.getElementById('pass').value;
    if (!(/(?=.{8,16})(?=.*?[^\w\s])(?=.*?[0-9])(?=.*?[A-Z]).*?[a-z].*/.test(valor))) {

        document.getElementById('pass').style.backgroundColor = "red";
    } else {
        document.getElementById('pass').style.backgroundColor = "#adff2f";
    }
}

are you interested in making this specific regex working? elsewhere you can divide your problem in smaller pieces, like checking length, etc. — vault, Feb 05 '13 at 01:37
Check it http://stackoverflow.com/questions/2370015/regular-expression-for-password-validation — Helielson Santos, Feb 05 '13 at 01:40
It would ideal if you provide a list of examples of what should be valid and what not. — elclanrs, Feb 05 '13 at 01:43
What's your reason for limiting the length of the password to 16 characters? If you're hashing (and salting, as you should be) your passwords, it won't make it take any more space in the database. The only thing you might be worried about is bandwidth, but validating it after you've received it does not help that. I know that I personally have some passwords that are over 32 characters long. — icktoofay, Feb 05 '13 at 01:48
it's already changed, but it doesn't work http://jsbin.com/ugesow/1/edit — Kakitori, Feb 05 '13 at 01:51

icktoofay · Answer 1 · 2013-02-05T02:00:27.853

Regular expressions are not a panacea. It's not too hard to do it, mixing with regular code:

function validatePassword(password) {
    // First, check the length.
    // Please see my comment on the question about maximum password lengths.
    if(password.length < 8 || password.length > 16) return false;
    // Next, check for alphabetic characters.
    if(!/[A-Z]/i.match(password)) return false;
    // Next, check for numbers.
    if(!/\d/.match(password)) return false;
    // Next, check for anything besides those.
    if(!/[^A-Z\d]/i.match(password)) return false;
    // If we're here, it's valid.
    return true;
}

However, I'd look into something like zxcvbn, a password checker, which I think is a better password quality checker, checking things like common dictionary words after un-13375p3/-\kification and dealing with entropy decently. It is used, among others, by Dropbox. Try it here.

that's how i would solve this :D – vault Feb 05 '13 at 01:53 — vault, Feb 05 '13 at 01:53

score 0 · Answer 2 · answered Feb 05 '13 at 01:46

0

You need to anchor the match to the beginning of the string, and anchor the first lookahead to the end:

^(?=.{8,16}$)

Also, the last lookahead needs to be split in two:

(?=.*?[A-Z])(?=.*?[a-z])

answered Feb 05 '13 at 01:46

Alan Moore

73,866
12
100
156

^(?=.{8,16}$) it's already chagend, but it doesn't work http://jsbin.com/ugesow/1/edit – Kakitori Feb 05 '13 at 01:52

score -3 · Answer 3 · answered Feb 05 '13 at 01:37

-3

Why don't you just test for the three character sets with regular expressions:

[A-Za-z0-9]+

Then count the length of the string to validate the length.

answered Feb 05 '13 at 01:37

Espresso

4,722
1
24
33

3

your regex accepts almost every non symbol character, this is not what he asked – vault Feb 05 '13 at 01:39
I used the notation found in "the Dragon Book" as I had thought that was the standard. I reckoned it would be easy enough to translate it to the JavaScript syntax. :\ – Espresso Feb 05 '13 at 01:50
1

I haven't read it, but I would expect a book on compilers to talk about theory-pure regular expressions, not the regexes we use for string manipulations. Big, *big* difference. – Alan Moore Feb 05 '13 at 02:00

score -3 · Answer 4 · edited May 23 '17 at 10:32

-3

What about this range:

/[A-Za-z0-9$-/:-?{-~!"^_`\[\]]/

So you can check first

/[A-Za-z]+/

then

/\d+/

and finally

/[$-/:-?{-~!"^_`\[\]]+/

If it passes you can check the length.

You can see this link to see why the symbols work.

edited May 23 '17 at 10:32

Community

1
1

answered Feb 05 '13 at 01:44

Kaeros

1,138
7
7

He can use these to check for the things he need, it's not the actual regex. – Kaeros Feb 05 '13 at 01:51
you seem the only one to think that – vault Feb 05 '13 at 01:52
Really? He can check for symbols, letters and numbers. So if he do something like: /[A-Za-z]+/ then /\d+/ and finally /[$-/:-?{-~!"^_`\[\]+] he can do what he wants... there is a better way, but is valid. – Kaeros Feb 05 '13 at 01:54
This does *not* do what the OP was asking for. A single character password would pass, which is *incorrect* by the requirement. – Andrew Barber Feb 06 '13 at 15:07

Regex to validate a password

4 Answers4