regex for passphrase

Question

I'm a newbie to regex and trying to create a regex to validate pass phrases. I would like to validate that the pass phrase has:

• n number of words or more
• words should be separated by spaces
• words, each with n characters or more
• a number in at least one of the words
• at least one special character in one of the words

This is what what I have so far

^(?=.*?((?:.*?\b[a-zA-Z0-9]{2,40}\b)\s*){3,})(?=.*?[@#$%^&+=])(?=.*?[0-9]).*$

It matches this Pe2sI#sHy?ThYulU# phrase that does not have at least 3 words (no spaces). What am I doing wrong?

Answer 1

You should use \s+ instead of \s*. The latter allows zero spaces, the former requires at least one. But your regex is overly complicated. Try this:

^                 # Start of string
(?=.*\d)          # Assert at least one digit
(?=.*[@#$%^&+=])  # Assert at least one special char
\s*               # Optional leading whitespace
(?:               # Match...
 \S{2,}           #  at least 2 non-spaces
 \s+              #  at least 1 whitespace
){2,}             # at least 2 times
\S{2,}            # Match at least 2 non-spaces (making 3 "words" minimum)

Answer 2

A little late to this, so this is just an observation.

This is a take-off on @Tim Pietzcker's method.
Although 'words' can be anything, if you want to require at least
3 words have [a-zA-Z0-9]{2,40} characters imbedded, you could do this.

^                      # String start
(?=.*[@#$%^&+=])       # Assert 1 special char
(?=.*\d)               # Assert 1 digit
(?:                    # Special 'Word Group'  -- Need 2 words
   .*                     # Any char, 0 or more times
   [a-zA-Z0-9]{2,40}      # Alpha/num char, 2 to 40 times
   .*                     # Any char, 0 or more times
   \s                     # a whitespace, only 1 required
){2}                   # 'Word Group' end, do 2 times
.*                     # Any char, 0 or more times
[a-zA-Z0-9]{2,40}      # Alpha/num char, 2 to 40 times -- Need 1 word

This should match at least 3 special [a-zA-Z0-9]{2,40} words separated by at least 1 space
including a digit and special character.

update

Yes, you can combine it into a single group done {3} times in 2 ways I know of.

Use a capture buffer as a flag

^(?=.*[@#$%^&+=])(?=.*\d)(?:(?:(?!\1)|\s).*[a-zA-Z0-9]{2,40}().*){3} 
                                                       ^          ^
---------------------------------------   

^                      # String start
(?=.*[@#$%^&+=])       # Assert 1 special char
(?=.*\d)               # Assert 1 digit
(?:                    # Special 'Word Group'
   (?:                    #.. grping start ....
        (?!\1)              # Either capt group 1 is UN-DEFINED
      | \s                  # OR, require a whitespace
    )                     #.. grping end ....
   .*                     # Any char, 0 or more times
   [a-zA-Z0-9]{2,40}      # Alpha/num char, 2 to 40 times
   ()                     # DEFINE Capture group 1
   .*                     # Any char, 0 or more times
){3}                   # 'Word Group' end, do 3 times

Or, by using a conditional

^(?=.*[@#$%^&+=])(?=.*\d)(?:(?(1)\s).*([a-zA-Z0-9]{2,40}).*){3}
                                                   ^         ^
---------------------------------------   

^                      # String start
(?=.*[@#$%^&+=])       # Assert 1 special char
(?=.*\d)               # Assert 1 digit
(?:                    # Special 'Word Group'
   (?(1)\s)               # Conditional, require a whitespace if capture group 1 captured anything
   .*                     # Any char, 0 or more times
   ([a-zA-Z0-9]{2,40})    # Capture group 1, Alpha/num char, 2 to 40 times
   .*                     # Any char, 0 or more times
){3}                   # 'Word Group' end, do 3 times