RegEx for Password Validation (ASP)

Question

Can someone suggest a regular expression for validating a password with the following conditions.

• Password must be at least 12 characters long
• Passwo

Answer 1

Although a bit unwieldy, this can be accomplished in a single regex like so:

Dim myRegExp
Set myRegExp = New RegExp
myRegExp.Pattern = "^(?=.{12})(?![0-9])(?:(?=[^a-z]*[a-z])(?=[^0-9]*[0-9])(?=[^\-_$#]*[\-_$#])|(?=[^A-Z]*[A-Z])(?=[^0-9]*[0-9])(?=[^\-_$#]*[\-_$#])|(?=[^A-Z]*[A-Z])(?=[^a-z]*[a-z])(?=[^\-_$#]*[\-_$#])|(?=[^A-Z]*[A-Z])(?=[^a-z]*[a-z])(?=[^0-9]*[0-9]))[A-Za-z0-9-_$#]+$"
If myRegExp.Test(SubjectString) Then
    ' Successful match
Else
    ' Match attempt failed
End If

Here is a commented version of the regex: (in PHP free-spacing mode syntax - which can be read by mere mortals):

$re_password = '/
    # Match password having multiple, specific requirements.
    ^                       # Anchor to start of string.
    (?=.{12})               # Password must be at least 12 characters long.
    (?![0-9])               # Password must not begin with a number.
    (?:                     # Password must have 3 out of 4 characteristics:
       # Either... Case 1: (All but R1).
      (?=[^a-z]*[a-z])      # R2: At least one lower case letter (a-z).
      (?=[^0-9]*[0-9])      # R3: At least one number (0-9).
      (?=[^-_$\#]*[-_$\#])  # R4: At least one of: [-_$#].
    |  # Or... Case 2: (All but R2).
      (?=[^A-Z]*[A-Z])      # R1: At least one upper case letter (A-Z).
      (?=[^0-9]*[0-9])      # R3: At least one number (0-9).
      (?=[^-_$\#]*[-_$\#])  # R4: At least one of: [-_$#].
    |  # Or... Case 3: (All but R3).
      (?=[^A-Z]*[A-Z])      # R1: At least one upper case letter (A-Z).
      (?=[^a-z]*[a-z])      # R2: At least one lower case letter (a-z).
      (?=[^-_$\#]*[-_$\#])  # R4: At least one of: [-_$#].
    |  # Or... Case 4: (All but R4).
      (?=[^A-Z]*[A-Z])      # R1: At least one upper case letter (A-Z).
      (?=[^a-z]*[a-z])      # R2: At least one lower case letter (a-z).
      (?=[^0-9]*[0-9])      # R3: At least one number (0-9).
    )                       # End group of 3-out-of-4 alternatives.
    [A-Za-z0-9-_$\#]+       # Match the password string.
    $                       # Anchor to end of string.
    /x';

This assumes that a password may not contain characters other than: [A-Z], [a-z], [0-9] and [-_$#]. It is also assumed that a password may contain characters from all 4 types.

The: "3 out of 4 requirements" is solved here by brute force (by explicitly specifying all possible case combinations as a group of alternatives - and repeating the common expressions for each case). This works here because there are only 4 possible cases to be tested, but this method grows very unwieldy if there are more requirements (e.g. "must meet 5 out of 20 requirements..."). As others have stated, there are definite advantages to breaking this up into multiple parts, e.g. you can have a custom error message with each failure mode.

But this can be accomplished with a single regex!

Edit 2011-10-20: Improved efficiency of the 4 requirements lookahead expressions by replacing the lazy-dot-stars with more precise greedy expressions.