Question

How do I verify in C# that the password contains at least X uppercase letters and at least Y numbers, and the entire string is longer than Z?

Thanks.

Answer 1

Password Strength:

First, I would read up on password strength, and double-check your policy to make sure you were doing the right thing (I couldn’t tell you off hand):

• http://en.wikipedia.org/wiki/Password_strength
• https://www.grc.com/haystack.htm
• http://xkcd.com/936/ (a joke, but good food for thought)

Then I’d check other questions:

• Creating a regex to check for a strong password
• Password strength

Then I’d get down to business.

Implementation:

You could use Linq:

return password.Length >= z
    && password.Where(char.IsUpper).Count() >= x
    && password.Where(char.IsDigit).Count() >= y
    ;

You could use also regular expressions (which might be a good option to allow you to plug in more complicated validations in the future):

return password.Length >= z
    && new Regex("[A-Z]").Matches(password).Count >= x
    && new Regex("[0-9]").Matches(password).Count >= y
    ;

Or you could mix and match them.

If you had to do this multiple times, you could reuse the Regex instances by building a class:

public class PasswordValidator
{
    public bool IsValid(string password)
    {
        return password.Length > MinimumLength
            && uppercaseCharacterMatcher.Matches(password).Count
                >= FewestUppercaseCharactersAllowed
            && digitsMatcher.Matches(password).Count >= FewestDigitsAllowed
            ;
    }

    public int FewestUppercaseCharactersAllowed { get; set; }
    public int FewestDigitsAllowed { get; set; }
    public int MinimumLength { get; set; }

    private Regex uppercaseCharacterMatcher = new Regex("[A-Z]");
    private Regex digitsMatcher = new Regex("[a-z]");
}

var validator = new PasswordValidator()
{
    FewestUppercaseCharactersAllowed = x,
    FewestDigitsAllowed = y,
    MinimumLength = z,
};

return validator.IsValid(password);