Password validation regex

Question

I am trying to get one regular expression that does the following:

makes sure there are no white-space characters
minimum length of 8
makes sure there is at least:
- one non-alpha character
- one upper case character
- one lower case character

I found this regular expression:

((?=.*[^a-zA-Z])(?=.*[a-z])(?=.*[A-Z])(?!\s).{8,})

which takes care of points 2 and 3 above, but how do I add the first requirement to the above regex expression?

I know I can do two expressions the one above and then

\s

but I'd like to have it all in one, I tried doing something like ?!\s but I couldn't get it to work. Any ideas?

What is the target language? I've seen this question before (cannot find it) and the solution was to split up the validation in to several steps (so not use only one regex). — Felix Kling, Feb 21 '11 at 17:04

score 17 · Accepted Answer · answered Feb 21 '11 at 17:05

17

^(?=.*[^a-zA-Z])(?=.*[a-z])(?=.*[A-Z])\S{8,}$

should do. Be aware, though, that you're only validating ASCII letters. Is Ä not a letter for your requirements?

\S means "any character except whitespace", so by using this instead of the dot, and by anchoring the regex at the start and end of the string, we make sure that the string doesn't contain any whitespace.

I also removed the unnecessary parentheses around the entire expression.

answered Feb 21 '11 at 17:05

Tim Pietzcker

328,213
58
503
561

This matches words without any upper-case characters e.g. 'passwordfoo1' – MrChaz Aug 28 '13 at 11:25
@MrChaz: No, it doesn't. The `(?=.*[A-Z])` part ensures this. (Unless you set a case-insensitive flag outside of the regex somewhere, of course). – Tim Pietzcker Aug 28 '13 at 11:29
It was indeed set, apologies. – MrChaz Aug 28 '13 at 12:35
Why the need for this `(?=.*[^a-zA-Z])` then `(?=.*[a-z])` and `(?=.*[A-Z])`. Doesn't the first do the job of the other 2? – the-a-train Sep 24 '13 at 06:37
@updog: Did you notice the `^` at the start of the [character class](http://www.regular-expressions.info/charclass.html)? – Tim Pietzcker Sep 24 '13 at 06:45
Yes I did, does this mean that the password has to start with an alpha character? – the-a-train Sep 25 '13 at 11:13
@updog: No. The `^` negates the contents of the character class. Take a look at the tutorial I had linked to above. – Tim Pietzcker Sep 25 '13 at 11:15
@TimPietzcker so that part of the expression is to match non a-zA-Z characters? – the-a-train Sep 26 '13 at 12:04
@updog: Yes, `[^a-zA-Z]` matches a single character that is not an ASCII letter. – Tim Pietzcker Sep 26 '13 at 13:08

score 7 · Answer 2 · answered Feb 21 '11 at 17:24

Tim's answer works well, and is a good reminder that there are many ways to solve the same problem with regexes, but you were on the right track to finding a solution yourself. If you had changed (?!\s) to (?!.*\s) and added the ^ and $ anchors to the end, it would work.

^((?=.*[^a-zA-Z])(?=.*[a-z])(?=.*[A-Z])(?!.*\s).{8,})$

Password validation regex

2 Answers2

Linked

Related