Using a Regular expression for password validation

Question

I am using following regular expression my java code.

^.*(?=.{6,20})(?=.*[a-z].*[a-z])(?=.*[A-Z])(?=.*[0-9]).*$

When I am trying to use same in xml as

^.\*(\?=.{6,20})(\?=.\*[a-z].\*[a-z])(\?=.\*[A-Z])(\?=.\*[0-9]).\*$

It is not working. It showing exception as below.

java.lang.IllegalArgumentException: cvc-pattern-valid: Value 'narendra1A' is not facet-valid with respect to pattern '^.*(\?=.{6,20})(\?=.*[a-z].*[a-z])(\?=.*[A-Z])(\?=.*[0-9]).*$' for type '#AnonType_passwordcreateUser'.

Can any one help in this regard.

Thanks,

Narendra

Unrelated to the question, but you should remove the first .* right after the ^. It's unnecessary and makes your regex very inefficient. Also, if you think you're restricting the password length to 6-20 characters, you're not. A 100-character string will pass this regex just fine. — Tim Pietzcker
– Tim Pietzcker, Commented Dec 8, 2010 at 11:01
@Gumbo: Doesn't matter, any string longer than 5 characters will pass, if you look at the regex closely :) — Tim Pietzcker
– Tim Pietzcker, Commented Dec 8, 2010 at 11:03

Stephen C · Accepted Answer · 2010-12-08 11:08:25Z

3

This does not directly answer your question, but it may be a better option for you than trying to do password quality checks with regexes.

The vt-password library is an excellent Java library that implements rule-based password quality checking. In addition to counting characters / character classes, it does things like checking against dictionaries, checking for passwords used previously, checking for repeated characters, etc.

(If you are using Spring, it is pretty simple to configure the password rule objects in a Spring XML wiring file. This allows you to adjust the rules without changing your code.)

edited Dec 8, 2010 at 11:08

answered Dec 8, 2010 at 11:03

Stephen C

723k95 gold badges849 silver badges1.3k bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Mohamed Saligh · Accepted Answer · 2010-12-08 11:15:33Z

0

Password Regular Expression Pattern

((?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[@#$%]).{6,20})

Description

(           # Start of group
  (?=.*\d)      #   must contains one digit from 0-9
  (?=.*[a-z])   #   must contains one lowercase characters
  (?=.*[A-Z])   #   must contains one uppercase characters
  (?=.*[@#$%])  #   must contains one special symbols in the list "@#$%"
     .          #     match anything with previous condition checking
       {6,20}   #        length at least 6 characters and maximum of 20 
)           # End of group

answered Dec 8, 2010 at 11:15

Mohamed Saligh

12.4k19 gold badges68 silver badges84 bronze badges

1 Comment

Gumbo Over a year ago

Better use the complements instead of .. So \D*\d, [^a-z]*[a-z], [^A-Z]*[A-Z], etc.

AlexR · Accepted Answer · 2010-12-08 11:23:11Z

0

Your pattern uses characters forbidden in XML document. To make things simple put password into CDATA.

answered Dec 8, 2010 at 11:23

AlexR

116k16 gold badges137 silver badges216 bronze badges

Comments

Stephen Kennedy · Accepted Answer · 2019-04-07 23:54:24Z

0

Try this

^.\*(\?:.{6,20})(\?:.\*[a-z].\*[a-z])(\?:.\*[A-Z])(\?:.\*[0-9]).\*$

edited Apr 7, 2019 at 23:54

Stephen Kennedy

21.8k24 gold badges99 silver badges114 bronze badges

answered Apr 7, 2019 at 23:47

gudgl

616 bronze badges

Collectives™ on Stack Overflow

Using a Regular expression for password validation

4 Answers 4

Comments

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related