A regular expression for validating secure passwords
Friday, August 1st, 2008
For one of our current projects I was looking for a way to validate strong passwords with regular expressions. Form field validation requirements are defined as a regex in the database properties for the field, so the easiest way to set up secure passwords was using this method. I found many examples for regular expressions but they all lacked one important feature. To avoid SQL injection issues or html formating issues we need to limit the characters allowed in passwords, and all regular expressions that I found on the web would not allow us to do this. Many of the examples posted also contained useless or redundant patterns. Here is my own pattern, which works in Perl, PHP, Java, and .Net. Needless to say that regex engines based on the old POSIX standard will not support something cryptic like this (read as one line):
(?=^[\w ,\.;:/\!@\#\$%&\*=\-\+\(\)\[\]\{\}\|]{10,}$)
(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*\W)
- ten or more characters long
- one or more a-z
- one or more A-Z
- one or more 0-9
- one or more ,.;:/!@#$%&*=-+()[]{}| (includes space)
You can easily test this pattern using online tools for different languages:
Perl (PCRE, surround pattern by ” “)
PHP (surround pattern by # #)
Java
.Net
Since version 5, released on February 8, 2008, 
All data on my laptop’s hard drive is encrypted. If the machine gets stolen, no one will be able to boot the operating system without entering the correct pass phrase beforehand. Nothing on the drive looks like a file of has any readable information. My letters, photos, and all other private information are no more than an cryptic stream of random bytes.
