Question

I ma using this article which explains how to use password strength validator.

The problem is that it doesn’t seem to check and count each step while typing a password. It seems like it checks for only more than 6 and more than 10 characters giving me maximum count of 3.

Might the problem be because I am using TextChanged function?

Here is my code from validator:

enum PasswordScore
{
    Blank = 0,
    VeryWeak = 1,
    Weak = 2,
    Medium = 3,
    Strong = 4,
    VeryStrong = 5
}

private static PasswordScore CheckStrength(string password)
{
    int score = 1;

        if (password.Length < 1)
            return PasswordScore.Blank;
        if (password.Length < 4)
            return PasswordScore.VeryWeak;

        if (password.Length >= 6)
        score++;
        if (password.Length >= 10)
            score++;
        if (Regex.IsMatch(password, @"/\d+/", RegexOptions.ECMAScript))
            score++;
    if (Regex.IsMatch(password, @"/[a-z]/", RegexOptions.ECMAScript) &&
        Regex.IsMatch(password, @"/[A-Z]/", RegexOptions.ECMAScript))
            score++;
    if (Regex.IsMatch(password, @"/.[!,@,#,$,%,^,&,*,?,_,~,-,£,(,)]/",
        RegexOptions.ECMAScript))
            score++;

        return (PasswordScore)score;
}

Here is my TextChanged function (note: the code where I am passing a value to checking method is in the second to the last line of this code):

    // Checking user input for variety of things.
    // This is intended as security measure.
    private void validateInput(object sender, EventArgs e)
    {
        // ======== Start validating Password field ========
        // Checking for Null or Empty string in password field.
        if (string.IsNullOrEmpty(txtPassword.Text))
        {
            lblMessagePass.Text = "Password field cannot be empty!";
            lblMessagePass.ForeColor = Color.IndianRed;
            btnAuthenticate.Enabled = false;
            passIsValid = false;
        }
        // Making sure that user name is at least 6 characters long.
        else if (txtPassword.Text.Length < 6)
        {
            lblMessagePass.Text = "Password field must be at least 6 characters long!";
            lblMessagePass.ForeColor = Color.IndianRed;
            btnAuthenticate.Enabled = false;
            passIsValid = false;
        }
        // Checking for password made of same repeating character.
        // Invalid input example: 'aaaaaa'
        else if (!txtPassword.Text.Distinct().Skip(1).Any())
        {
            lblMessagePass.Text = "Password cannot be made of repeating the same characters!";
            lblMessagePass.ForeColor = Color.IndianRed;
            btnAuthenticate.Enabled = false;
            passIsValid = false;
        }
        // Making sure that user name and password are not the same.
        // Security measure.
        else if (txtUserName.Text == txtPassword.Text)
        {
            lblMessagePass.Text = "User Name and Password can not be the same!";
            lblMessagePass.ForeColor = Color.IndianRed;
            btnAuthenticate.Enabled = false;
            passIsValid = false;
        }
        // If all other checks aren't trigered; enable authentication.
        else
        {
            lblMessagePass.Text = "Password is valid.";
            lblMessagePass.ForeColor = Color.Green;

            passIsValid = true;

            if (passIsValid && userIsValid)
            {
                btnAuthenticate.Enabled = true;
            }
        }
        // ======== End validating Password field ========

        lblStrength.Text = CheckStrength(txtPassword.Text).ToString();
    }

Answer 1

You don’t need the slashes (/) in your Regex patterns, or the commas in the last one.
Try this:

if (Regex.IsMatch(password, @"\d+", RegexOptions.ECMAScript))
    score++;
if (Regex.IsMatch(password, @"[a-z]", RegexOptions.ECMAScript) &&
    Regex.IsMatch(password, @"[A-Z]", RegexOptions.ECMAScript))
    score++;
if (Regex.IsMatch(password, @".[!@#\$%\^&\*\?_~\-£\(\)]", RegexOptions.ECMAScript))
    score++;