Javascript password validation

Question

I've a pretty good password validation, but I would like to add some more functionality.

You can see an example here http://jsfiddle.net/yfM5T/22/

Currently I've a password that checks, 7 chars, 1 upper case, 1 digit and 1 special character and even it won't allow white space.

But I want to add

password doesn't contains 9 consecutive numbers (because some people use phone numbers as passwords, e.g. it won't take Pass@123456789 but Pass123456@789 is ok)
Not same as the log-in name
Not more than two repeating characters (saaga is ok but saaaga is not allowed)

Bonus if the password validation tool tip shows the white space validation message only if the user put a white space rather than showing onfocus (only for the white space, 9 consequtive numbers, username etc.)

Something interesting to think about. The more rules you apply, the more homogenized your passwords become. Then they are easier to brute force. Just saying — Joe
– Joe, Commented Nov 11, 2011 at 15:38
Because its banking solutions so password rules is very important. My manager decides everything :(.. — Jay
– Jay, Commented Nov 11, 2011 at 15:40
If you must do this sort of thing (and generally it really irritates me, and causes lots of customer support issues when people forget their passwords), it'd be better to do some general statistical analysis on the characters used instead of applying the sort of "rules" you describe, which probably have no analytical basis for improving security. Just my opinion :-) — Pointy
– Pointy, Commented Nov 11, 2011 at 15:40
I think you're crossing the line between securing, and annoying your users. Forcing them to use at least one uppercase or perhaps a number will secure it enough, as long as you're storing them properly on your end. Remember, most people get hacked through social engineering and not actual hacking/brute force attacks. However, if you're just trying to force your users not to use their username, than that's a simple if statement. If you don't want them to use phone numbers, use a regular expression. — Jack Marchetti
– Jack Marchetti, Commented Nov 11, 2011 at 15:41

FailedDev · Accepted Answer · 2011-11-11 15:56:55Z

2

1) ^(?!.*\d{9}.*)
3) ^(?!.*([a-zA-Z])\1\1)

For the second rule just use a string comparison with the username.

answered Nov 11, 2011 at 15:56

FailedDev

27k9 gold badges56 silver badges74 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Javascript password validation

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related