Question

In my regex expression, I was trying to match a password between 8 and 16 character, with at least 2 of each of the following: lowercase letters, capital letters, and digits.

In my expression I have:

^((?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,16})$

But I don’t understand why it wouldn’t work like this:

^((?=\d)(?=[a-z])(?=[A-Z])(?=\d)(?=[a-z])(?=[A-Z]){8,16})$

Doesnt “.*” just meant “zero or more of any character”? So why would I need that if I’m just checking for specific conditions?

And why did I need the period before the curly braces defining the limit of the password?

And one more thing, I don’t understand what it means to “not consume any of the string” in reference to “?=”.

Answer 1

Your last two questions are related. The ?= (which is called a lookahead, by the way) doesn’t consume any of the string, meaning that it tests a condition of the string but itself is zero-characters long. If the lookahead is true, then the matching continues, but the next part of the expression starts from where you were before you checked the lookahead.

Because all your stuff is made up of lookaheads, they all add up to zero characters in length. So, for {8,16} to match something, you need to supply the . first. .{8,16} means “8 to 16 characters, I don’t care what those characters are.” {8,16} without anything before it isn’t a valid expression (or at least won’t mean what .{8,16} means).

Regarding your first question, you need .* in each of your lookaheads because your expression starts with ^. That means “starting at the very beginning of the string” rather than “matching anywhere within the string”. Since you’re not trying to match only at the beginning of the string, .* allows you to have the lookaheads affect anywhere in the string.

Lastly, I’m afraid your regexp doesn’t work. Because the lookaheads are zero-length, putting the same lookahead in twice as you have done will match the same thing twice. So this expression only checks if you have a single instance of each of the types of characters that you want to enforce there being two instances of. The expression you want is more like this:

^((?=.*\d.*\d)(?=.*[a-z].*[a-z])(?=.*[A-Z].*[A-Z]).{8,16})$

And that expression is equivalent to the more elegant:

^((?=(.*\d){2})(?=(.*[a-z]){2})(?=(.*[A-Z]){2}).{8,16})$

(And, giving credit where it’s due, Dennis beat me to that last expression. Well done, sir.)