Skip to content

Password regex that requires “at least two of” certain characters

Im working on javascript regex which includes having following conditions. So far with no luck.

-The minimum character count allowed is 8.

-The maximum character count allowed is 64.

-The entered text should include at least two of the following – numbers, lowercase letters, uppercase letters, Special characters.

-Entering symbols will not be supported.

So far what I have is this @anubhava answer here.

^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[#[email protected]$%^&*-]).{8,63}$

This regex will enforce these rules:

-At least one upper case English letter, (?=.*?[A-Z])

-At least one lower case English letter, (?=.*?[a-z])

-At least one digit, (?=.*?[0-9])

-At least one special character, (?=.?[#[email protected]$%^&-])

-Minimum eight in length .{8,63} (with the anchors)

My Question is how do I satify my 3rd and 4th conditions Which is :-

-The entered text should include at least two of the following – numbers, lowercase letters, uppercase letters, Special characters.

-Entering symbols will not be supported.

Any help would be appreciated.

Answer

^(?!.*[^A-Za-z0-9#[email protected]$%^&*-]$)(?![a-z]*$)(?![A-Z]*$)(?![0-9]*$)(?![#[email protected]$%^&*-]*$).{8,64}$

The string should not contain any symbol outside the 4 groups of characters

^(?!.*[^A-Za-z0-9#[email protected]$%^&*-]$)

The string should not consist only of lower letters

(?![a-z]*$)

The string should not consist only of upper letters

(?![A-Z]*$)

The string should not consist only of digits

(?![0-9]*$)

The string should not consist only of special characters

(?![#[email protected]$%^&*-]*$)

The string should consist of 8 to 64 characters

.{8,64}$

UPDATED 2020-09-07

If the string should contain symbols of at list 3 groups of 4

^(?!.*[^A-Za-z0-9#[email protected]$%^&*-]$)((?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])|(?=.*[a-z])(?=.*[A-Z])(?=.*[#[email protected]$%^&*-])|(?=.*[a-z])(?=.*[0-9])(?=.*[#[email protected]$%^&*-])|(?=.*[A-Z])(?=.*[0-9])(?=.*[#[email protected]$%^&*-])).{8,64}$

The string should not contain any symbol outside the 4 groups of characters

^(?!.*[^A-Za-z0-9#[email protected]$%^&*-]$)

Then 4 variants of 3 groups of 4 that the symbols should be member of:

(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])

or

(?=.*[a-z])(?=.*[A-Z])(?=.*[#[email protected]$%^&*-])

or

(?=.*[a-z])(?=.*[0-9])(?=.*[#[email protected]$%^&*-])

or

(?=.*[A-Z])(?=.*[0-9])(?=.*[#[email protected]$%^&*-])

and finally the string should consist of 8 to 64 characters

.{8,64}$