To require a different minimum or maximum length, change the numbers used as the upper and lower bounds for the quantifier ‹{8,32}›. If you don’t want to specify a maximum, use ‹{8,}›, or remove the ‹$› anchor and change the quantifier to ‹{8}›.

All of the programming languages covered by this book provide a simple and efficient way to determine the length of a string. However, using a regex allows you to test both the minimum and maximum length at the same time, and makes it easier to mix and match password complexity rules by choosing from a list of regexes.

As mentioned earlier, this regex allows the characters A–Z, a–z, 0–9, space, and ASCII punctuation only. To be more specific about the allowed punctuation characters, they are !, ", #, $, %, &, ', (, ), *, +, -, ., /, :, ;, <, =, >, ?, @, [, \, ], ^, _, `, {, |, }, ~, and comma. In other words, all the punctuation you can type using a standard U.S. keyboard.

Limiting passwords to these characters can help avoid character encoding related issues, but keep in mind that it also limits the potential complexity of your passwords.

To check whether the password contains two or more uppercase letters, use ‹[A-Z].*[A-Z]›. For three or more, use ‹[A-Z].*[A-Z].*[A-Z]› or ‹(?:[A-Z].*){3}›. If you’re allowing any Unicode uppercase letters, just change each ‹[A-Z]› in the preceding examples to ‹\p{Lu}›. In JavaScript, replace the dots with ‹[\s\S]›.

As with the “uppercase letters” regex, you can check whether the password contains at least two lowercase letters using ‹[a-z].*[a-z]›. For three or more, use ‹[a-z].*[a-z].*[a-z]› or ‹(?:[a-z].*){3}›. If you’re allowing any Unicode lowercase letters, change each ‹[a-z]› to ‹\p{Ll}›. In JavaScript, replace the dots with ‹[\s\S]›.

You can check whether the password contains two or more numbers using ‹[0-9].*[0-9]›, and ‹[0-9].*[0-9].*[0-9]› or ‹(?:[0-9].*){3}› for three or more. In JavaScript, replace the dots with ‹[\s\S]›.

We didn’t include a listing for matching any Unicode decimal digit (‹\p{Nd}›), because it’s uncommon to treat characters other than 0–9 as numbers (although readers who speak Arabic or Hindi might disagree!).

Use the same principles shown for letters and numbers if you want to require more than one special character. For instance, using ‹[^A-Za-z0-9].*[^A-Za-z0-9]› would require the password to contain at least two special characters.

Note that ‹[^A-Za-z0-9]› is different than ‹\W› (the negated version of the ‹\w› shorthand for word characters). ‹\W› goes beyond ‹[^A-Za-z0-9]› by additionally excluding the underscore, which we don’t want to do here. In some regex flavors, ‹\W› also excludes any Unicode letter or decimal digit from any language.

This regex matches repeated characters using backreferences to a previously matched character. Recipe 2.10 explains how backreferences work. If you want to disallow any use of repeated characters, change the regex to ‹(.)\1›. To allow up to three repeated characters but not four, use ‹(.)\1\1\1› or ‹(.)\1{3}›.

Remember that you need to check whether this regular expression doesn’t match your subject text. A match would indicate that repeated characters are present.