Regex for custom password requirements

Question

I was trying to create a regex as per the password requirements.The requirement is

Minimum eight (8) characters
At least one number (0-9)
Any three of the following:
- Lowercase
- Uppercase
- Number
Special character ( ! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~ )

I created this regex

/^[0-9a-zA-Z\s!"#$\%&'\(\)\*\+\,\-\.\/\:;<=>?@\[\\\]\^\_\`\{\|\}\~]+$/g

I don't have that much knowledge of regex so just need confirmation is it right regex or need changes.

If I've read it correctly, your regex is `^[long list of alternatives]+$`. Well, in this case it will also match `hello`. — Enlico, Feb 03 '20 at 07:27
Complex password rules will usually not lead to more safe passwords, important is only a minimum length. People cannot remember tons of strong passwords, and such rules can interfere with good password schemes. People can get very inventive to bypass such rules, e.g. by using weak passwords like "Password-2020". Often you end up with weaker passwords instead of stronger ones. NIST published an [official paper](https://pages.nist.gov/800-63-3/sp800-63b.html) advising against such rules, and against its former recommendations. — martinstoeckli, Feb 03 '20 at 12:38

score 0 · Answer 1 · edited Jun 20 '20 at 09:12

How about this:

^(?=.{8,})(?=.*?\d)(?=.*[\s!\"#$\%&'\(\)\*\+\,\-\.\/\:;<=>?@\[\\\]\^\_\`\{\|\}\~])(?=[a-zA-Z0-9].*?[a-zA-Z0-9].*?[a-zA-Z0-9].*?).*$

As seen here at regex101.com

Explanation:

I've used a lot of positive lookaheads, which you can read more about here

Basically, a forward lookahead ensures that some position has some characters in front of it. After checking if the start of the password is followed by all your conditions, we then match the password.
Think of it like this: You make sure everything is correct, and if it is, then you match the password. Otherwise you don't.

(?=.{8,}) checks if there are at least 8 characters
(?=.*?\d) checks if there is at least 1 digit
^(?=.{8,})(?=.*?\d)(?=.*[\s!\"#$\%&'\*\+\,\-\.\/\:;<=>?@\[\\\]\^\_\`\{\|\}\~]) checks if there are at least 3 letters and/or numbers

score 0 · Accepted Answer · answered Feb 03 '20 at 07:31

You can try this

^(?=.*\d)[ !"#$%&'()*+,.\/:;<=>?@[\]^`{|}~\w-]{8,}$

Code example

const regex = /^(?=.*\d)[ !"#$%&'()*+,.\/:;<=>?@[\]^`{|}~\w-]{8,}$/gm;
const str = `1234
adnc
123456789
abcdefghij
ABCDEFGHIJ
1ABCDEFG
123-ANCNA
`;
let m;

while ((m = regex.exec(str)) !== null) {
    // This is necessary to avoid infinite loops with zero-width matches
    if (m.index === regex.lastIndex) {
        regex.lastIndex++;
    }
    
    // The result can be accessed through the `m`-variable.
    m.forEach((match, groupIndex) => {
        console.log(`Found match, group ${groupIndex}: ${match}`);
    });
}

PS:- I have replaced \s from pattern with , if you need to match all type of space character you can replace with \s again

Regex for custom password requirements

2 Answers2

Explanation: