Regexp Java for password validation

Question

I'm creating a regexp for password validation that will be used in a Java Application as a configuration parameter.

The regexp is:

^.*(?=.{8,})(?=..*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[@#$%^&+=]).*$

The password policy is:

• At least 8 chars
• Contains at least one digit
• Contains at least one lower alpha char and one upper alpha char
• Contains at least one char within a set of special char (@#%$^ etc.)
• Not containing blank, tab etc.

I'm missing just the point 5. I'm not able to include into the regexp the check on not containing blank tab carriage return etc.

Anyone could help me?

Answer 1

Please take a step back. Why do you restrict the special characters? What's wrong with underscore, for example? Can't your DB handle spaces?

If your database can handle any character code, you should allow your users to use any character they like in the password. For example, hörgh3 is a very secure password because most keyboards in the world simply don't have an ö

Answer 2

Try this:

^(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[@#$%^&+=])(?=[^\s]+$).{8,}$

Explanation:

^                 # start-of-string
(?=.*[0-9])       # a digit must occur at least once
(?=.*[a-z])       # a lower case letter must occur at least once
(?=.*[A-Z])       # an upper case letter must occur at least once
(?=.*[@#$%^&+=])  # a special character must occur at least once
(?=[^\s]+$)       # no whitespace allowed in the entire string
.{8,}             # anything, at least eight places though
$                 # end-of-string

The (?=.*[xyz]) construct eats the entire string (.*) and backtracks to the first occurrence where [xyz] can match. It succeeds if [xyz] is found, it fails otherwise.

The alternative would be using a reluctant qualifier: (?=.*?[xyz]). For a password check, this will hardly make any difference, for much longer strings it could be the more efficient variant.

The most efficient variant (but hardest to read and maintain, therefore the most error-prone) would be (?=[^xyz]*[xyz]), of course. For a regex of this length and for this purpose, I would dis-recommend doing it that way, as it has no real benefits.