Java regex validate password examples

By mkyong | Updated: November 5, 2020

Viewed: 26,776 (+151 pv/w)

Tags: java regex password regex secure password validator

This article shows how to use regex to validate a password in Java.

Secure Password requirements

1. Password must contain at least one digit [0-9].
2. Password must contain at least one lowercase Latin character [a-z].
3. Password must contain at least one uppercase Latin character [A-Z].
4. Password must contain at least one special character like ! @ # & ( ).
5. Password must contain a length of at least 8 characters and a maximum of 20 characters.

Below is the regex that matches all the above requirements.

  ^(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[!@#&()–[{}]:;',?/*~$^+=<>]).{8,20}$

1. Regex password explanation

The password must contain at least one lowercase character, one uppercase character, one digit, one special character, and a length between 8 to 20. The below regex uses positive lookahead for the conditional checking.

^                                   # start of line
  (?=.*[0-9])                       # positive lookahead, digit [0-9]
  (?=.*[a-z])                       # positive lookahead, one lowercase character [a-z]
  (?=.*[A-Z])                       # positive lookahead, one uppercase character [A-Z]
  (?=.*[!@#&()–[{}]:;',?/*~$^+=<>]) # positive lookahead, one of the special character in this [..]
  .                                 # matches anything
  {8,20}                            # length at least 8 characters and maximum of 20 characters
$                                   # end of line

In regex, there is positive lookahead (?=) and negative lookahead (?!):

• Positive lookahead (?=) ensures something followed by something else.
• Negative lookahead (?!) ensures something NOT followed by something else.

For example, b(?=c) matches a b that is followed by a c. (positive lookahead)
For example, b(?!c) matches a b that is NOT followed by a c. (negative lookahead)

2. Regex to validate the password

Below is a Java regex example to validate a password.

package com.mkyong.regex.password;

import java.util.regex.Matcher;
import java.util.regex.Pattern;

public class PasswordValidator {

    // digit + lowercase char + uppercase char + punctuation + symbol
    private static final String PASSWORD_PATTERN =
            "^(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[!@#&()–[{}]:;',?/*~$^+=<>]).{8,20}$";

    private static final Pattern pattern = Pattern.compile(PASSWORD_PATTERN);

    public static boolean isValid(final String password) {
        Matcher matcher = pattern.matcher(password);
        return matcher.matches();
    }

}

3. Regex password unit tests

Here are the unit tests to test a list of valid and invalid passwords.

package com.mkyong.regex.password;

import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.MethodSource;

import java.util.stream.Stream;

import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertTrue;

public class PasswordValidatorTest {

    @ParameterizedTest(name = "#{index} - Run test with password = {0}")
    @MethodSource("validPasswordProvider")
    void test_password_regex_valid(String password) {
        assertTrue(PasswordValidator.isValid(password));
    }

    @ParameterizedTest(name = "#{index} - Run test with password = {0}")
    @MethodSource("invalidPasswordProvider")
    void test_password_regex_invalid(String password) {
        assertFalse(PasswordValidator.isValid(password));
    }

    static Stream<String> validPasswordProvider() {
        return Stream.of(
                "AAAbbbccc@123",
                "Hello world$123",
                "A!@#&()–a1",               // test punctuation part 1
                "A[{}]:;',?/*a1",           // test punctuation part 2
                "A~$^+=<>a1",               // test symbols
                "0123456789$abcdefgAB",     // test 20 chars
                "123Aa$Aa"                  // test 8 chars
        );
    }

    // At least
    // one lowercase character,
    // one uppercase character,
    // one digit,
    // one special character
    // and length between 8 to 20.
    static Stream<String> invalidPasswordProvider() {
        return Stream.of(
                "12345678",                 // invalid, only digit
                "abcdefgh",                 // invalid, only lowercase
                "ABCDEFGH",                 // invalid, only uppercase
                "abc123$$$",                // invalid, at least one uppercase
                "ABC123$$$",                // invalid, at least one lowercase
                "ABC$$$$$$",                // invalid, at least one digit
                "java REGEX 123",           // invalid, at least one special character
                "java REGEX 123 %",         // invalid, % is not in the special character group []
                "________",                 // invalid
                "--------",                 // invalid
                " ",                        // empty
                "");                        // empty
    }
}

All passed.

4. FAQs

Below are some commonly asked questions:

• Why longer password is more secured?
• Why must mix at least one special character?

Answer:
For Latin characters, lowercase and uppercase [a-zA-Z], it consists of 52 characters; for the digits [0-9], it consists of 10 characters, a total of 62 characters.

• If a password contains a length of 1, it consists of 62 possibilities, [a-zA-Z0-9]. It means the worst case; we need to guess 62 times to find out the correct password.
• For a length of 2, it is 62 x 62 or 62 ^ 2 = 3,844
• 62 ^ 3 = 238,328
• 62 ^ 4 = 14,776,336
• 62 ^ 5 = 916,132,832
• 62 ^ 6 = 56,800,235,584
• 62 ^ 7 = 3,521,614,606,208
• 62 ^ 8 = 218,340,105,584,896
• A longer password is more secured, because it makes attackers harder to guess the correct password. Get the idea?

If we included the special characters like punctuation ! @ # & ( ) – [ { } ] : ; ' , ? / * (18 characters) and symbols ~ $ ^ + = < > (7 characters), it will greatly increase difficulties of guesting the correct password. I’m not really sure how many special characters are there, let takes it as 25 characters (estimated).

For 62 alphanumeric characters + 25 special characters, it is a total of 87 characters.

• 87 ^ 1 = 87
• 87 ^ 2 = 7,569
• 87 ^ 3 = 658,503
• 87 ^ 4 = 57,289,761
• 87 ^ 5 = 4,984,209,207
• 87 ^ 6 = 433,626,201,009
• 87 ^ 7 = 37,725,479,487,783
• 87 ^ 8 = 3,282,116,715,437,121

Mixed with special characters will significantly increase the difficulties of guesting the correct password.

Download Source Code

References

• Wikipedia – Alphanumericals
• Wikipedia – Password Strength
• Regex – Lookahead and Lookbehind Zero-Length Assertions
• JUnit 5 Parameterized Tests
• Password & Username Best Practices
• Indexing non-alphanumeric characters
• Top 5 Strongest Password
• Java password generator example