Question

I was going to write a regular expression that would match only if a string contains at least n different classes of characters. I was going to use this to force my users to create strong passwords and wanted to check if the password contains at least 3 of the following:

• Characters
• Capital Characters
• Numbers
• Special Characters

Writing a regular expression that matches if all of those classes are present is trivial using lookaheads. However, I cannot wrap my head around the “at least 3” part. Is this even possible (in a nice, compact expression) or would I have to create a monster expression?

Answer 1

I think this will be more compact than listing each possible combination of 3 of the 4. It utilizes negative lookahead to make sure that the entire string is not composed of only one or two of the character classes you listed:

(?!([a-zA-Z]*|[a-z\d]*|[^A-Z\d]*|[A-Z\d]*|[^a-z\d]*|[^a-zA-Z]*)$).*

In order, the groups here are:

• lower and/or upper
• lower and/or digits
• lower and/or special
• upper and/or digits
• upper and/or special
• digits and/or special

This regex will fail if the entire string (because of the $ in the negative lookahead) contains only characters from any of the above groups.