Question

I can’t seem to wrap my head around this one and thought I’d ask for some help here!

Basically I am validating a password field and the requirements are as follows:
– Must contain 3 consecutive letters
– Must contain at least 2 digits
– Can be in any order (e.g. 1abc342, abc24g3, 11abcsjf)

Here is what I have so far but I believe it needs some tweaking:
/[a-z]{3}[0-9][0-9]/i

Answer 1

You should probably do this in two separate regular expressions: one to test for three consecutive letters and one to test for at least two digits:

/[a-z]{3}/i
/\d.*d/

Make sure both conditions are met. You could use lookahead to combine this into one regex, but I think two regexes is clearer code and a better solution.

But if I may inject some opinion on the matter: Unless you have no control over this (client specified this), I’d highly recommend not imposing password restrictions like this. They actually make your password system far less secure, not more secure. Some reading on why:

http://jimpravetz.com/blog/2011/06/cheap-gpus-are-rendering-strong-passwords-use/

http://jimpravetz.com/blog/2012/02/stupid-password-rules/