Pages

Thursday, January 22, 2009

Password Complexity Regex

Here is a Password Complexity Regex that I came up with. It requires length of 8, at least one digit, one special character and mixed case. I have broken it across four lines to make it easy to read. Just take the carriage returns out if you want to use it.

(?=[@#!$%&+=\-_a-zA-Z0-9]*?[A-Z])
(?=[@#!$%&+=\-_a-zA-Z0-9]*?[a-z])
(?=[@#!$%&+=\-_a-zA-Z0-9]*?[0-9])
[@#!$%&+=\-_a-zA-Z0-9]{8,}

Special chars that are allowed are @#!$%&+=-_

If you want to change the length of the password accepted, (say 12) alter the last term to read {12,}

Unlike IBM I won't try to patent it http://yro.slashdot.org/firehose.pl?id=4629161&op=view. You may use it freely.

Updated per comments by Cadacus ... Thanks!

3 comments:

  1. abcdef12 - passes but doesn't meet criteria
    Abcde1-2 - fails but meets criteria

    ReplyDelete
  2. found the fix... make sure you quote - in the regex when you don't want to indicate ranges... for example..
    (?=[@#!$%&+=\- <---- used "\" to quote "-"

    this fixes the issue with Abcde1-2 and makes your regex a fantastic solution.. thank you so much!

    ReplyDelete
  3. (?=[@#!$%&+=\-_a-zA-Z0-9]*?[A-Z])
    (?=[@#!$%&+=\-_a-zA-Z0-9]*?[a-z])
    (?=[@#!$%&+=\-_a-zA-Z0-9]*?[0-9])
    (?=[@#!$%&+=\-_a-zA-Z0-9]*?[@#!$%&+=\-_])[@#!$%&+=\-_a-zA-Z0-9]{8,}

    ok, tracked it down.. this expression does what you advertise, again thank you so much for posting it.

    ReplyDelete