Password validation in php using regular expression

One possible regex pattern is:

/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[a-zA-Z\d]{8,}$/

As in this example.

But you really shouldn't limit passwords!

Admit it. As a developer we have done more to contribute to the failure of our customer's and user's online security because we are too stubborn or lazy to handle passwords properly. Just look at some of the fruit of our labor:

Password must be between 5 and 32 characters in length. Valid characters include letters, numbers, and underscore.

Password must be between 6 and 12 characters in length. Valid characters include letters and numbers.

Password must be a minimum of 8 characters and contain at least one capital letter, a number and a special character such as an underscore or exclamation point.

Then there is this gem. The original requirements were a minimum of 8 characters. Accidentally putting in 7 characters causes an error to appear before the user:

Password Limitation Gone Wrong Note the tag line. Irony?

I could go on here, but I think you get the point. We have written code to support this nonsense, wrapping our heads around the right regex to account for every case. Agonizing over transmission, hashing and storage. We've talked about this so much the situation has even received proper pop culture status with its memorialization on xkcd.

There is no doubt our intentions were good. After all, users and customers cannot be expected to protect themselves properly. They don't create strong passwords, they use the word 'password' as their password more often than not. They don't heed the warnings, the news stories or the horror exrpressed by friends who have suffered through identity theft. The hacking of large retail chains phases them very little. We, as developers, set out to help our users avoid these pitfalls. I will alledge our attempts fell short and may have even contributed to the problem.

Very likely we've made it worse.

By placing arcane restrictions on passwords we have actually forced our users into a bad way of thinking and therefore made them seek the path of least resistance, simple, hackable passwords. We did this because we were used to restrictions on us. Sysadmins limited us to 8 characters so we projected the limit on to the rest of the world. It is time we stopped and learned how to handle any length of password with any character included. We may want to exclude white spaces from the password, but other than that we shouldn't place any restrictions on passwords.

Then we can encourage good security practices like passphrases or random words. Users, once they discover this, will be blissfully happy they don't have to remember some goofy combination of letters and numbers like f@rtp00p.

I can see you rolling your eyes. It means you have to learn how to properly hash passwords and how to compare entered passwords with the hashes. You'll have to toss some really hard won regex. Heaven forbid you might have to refactor some code! Databases can hold very large hashed passwords and we should take advantage of the capability.

Keep in mind the general security of the data is on me, the developer along with the sysadmin and others. The security of a user's account is on them and I shouldn't do anything to hold them back. Personally I do not care what my users have for their passwords. All I do when users create their passwords is provide a strength meter and some basic guidelines:

"We have found using passphrases or multiple word combinations to be the most secure when it comes to preventing a hacker, who is trying to crack your login information, from being successful."

What should you do?

PHP's built-in functions handle password security perfectly, spaces, special characters and all.. If you're using a PHP version less than 5.5 you can use the password_hash() compatibility pack.

We need to remove the limitations on passwords and free up the users to own their security online. Are you in?

In this previous tutorial we created a simple registration form.

Websites often require a specific strength for a password. In this lesson we will use RegEx to test the password strength.

For our password strength we will specify the following requirements:

• a minimum of 8 characters

• at least one uppercase letter

• at least one number (digit)

• at least one of the following special characters !@#$%^&*-

We will start with a basic PHP file and assume that the user has already input their password which we are storing in the variable $password.

Line 2: we have stored the user password in the variable $password

Line 3: this is where we will define the pattern we need to match

Lines 4 to 8: we will test if the password is strong enough and output a message

Line 4: we need to test if the password is strong enough. At the moment we just have pseudo code. We will use a PHP function called preg_match()

The preg_match() function

Currently we just have some psuedo code on line 4. We will use the preg_match function to check if the password matches the defined pattern as follows:

Now we need to define the pattern.

Defining Delimiters

The first step is to define the delimiters, which are just forward slashes:

Defining the Start and End of the Pattern

Now we define the start and end of the pattern using ^ for the start and $ for the end:

Minimum of 8 Characters

The first condition for the password is that it must have at least 8 characters:

We have added .{8,}

The dot means any character.

{8,} means at least 8 characters and no maximum.

If we wanted to specify that the password must be exactly 8 characters then we would use .{8}

If we wanted to specify a minimum of 8 characters and a maximum of 20 characters for the password then we would use .{8,20}

Minimum of 1 Uppercase Character

Next, we need to have a minimum of 1 uppercase character:

We have added (?=.*[A-Z])

?= means look ahead through the password.

.* means look for any number of characters.

[A-Z] means look for any uppercase characters between A and Z inclusive.

Note that we have placed this part of the pattern BEFORE the minimum number check.

Minimum of 1 Number (Digit)

We have added (?=.*[0-9])

?= means look ahead through the password.

.* means look for any number of characters.

[0-9] means look for any digit between 0 and 9 inclusive.

Minimum of 1 of the Following Special Characters !@#$%^&*-

At this point you can probably guess what you need to include.

We have added (?=.*[!@#$%^&*-])

?= means look ahead through the password.

.* means look for any number of characters.

[!@#$%^&*-] means look for any of these characters.

How to validation Password in PHP?

How can I get password and confirm password in PHP?

How do you validate a password?

What are Regular Expressions in PHP?