How to validate password with regular expression
Password Regular Expression Pattern
((?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[@#$%]).{6,20})
Description
( # Start of group (?=.*\d) # must contains one digit from 0-9 (?=.*[a-z]) # must contains one lowercase characters (?=.*[A-Z]) # must contains one uppercase characters (?=.*[@#$%]) # must contains one special symbols in the list "@#$%" . # match anything with previous condition checking {6,20} # length at least 6 characters and maximum of 20 ) # End of group
?= – means apply the assertion condition, meaningless by itself, always work with other combination
Whole combination is means, 6 to 20 characters string with at least one digit, one upper case letter, one lower case letter and one special symbol (“@#$%”). This regular expression pattern is very useful to implement a strong and complex password.
P.S The grouping formula order is doesn’t matter.
Java Regular Expression Example
package com.mkyong.regex; import java.util.regex.Matcher; import java.util.regex.Pattern; public class PasswordValidator{ private Pattern pattern; private Matcher matcher; private static final String PASSWORD_PATTERN = "((?=.*\\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[@#$%]).{6,20})"; public PasswordValidator(){ pattern = Pattern.compile(PASSWORD_PATTERN); } /** * Validate password with regular expression * @param password password for validation * @return true valid password, false invalid password */ public boolean validate(final String password){ matcher = pattern.matcher(password); return matcher.matches(); } }
Password that match:
1. mkyong1A@
2. mkYOn12$
Password that doesn’t match:
1. mY1A@ , too short, minimum 6 characters
2. mkyong12@ , uppercase characters is required
3. mkyoNg12* , special symbol “*” is not allow here
4. mkyonG$$, digit is required
5. MKYONG12$ , lower case character is required
Unit Test – PasswordValidator
package com.mkyong.regex; import org.testng.Assert; import org.testng.annotations.*; /** * Password validator Testing * @author mkyong * */ public class PasswordValidatorTest { private PasswordValidator passwordValidator; @BeforeClass public void initData(){ passwordValidator = new PasswordValidator(); } @DataProvider public Object[][] ValidPasswordProvider() { return new Object[][]{ {new String[] { "mkyong1A@", "mkYOn12$", }} }; } @DataProvider public Object[][] InvalidPasswordProvider() { return new Object[][]{ {new String[] { "mY1A@","mkyong12@","mkyoNg12*", "mkyonG$$","MKYONG12$" }} }; } @Test(dataProvider = "ValidPasswordProvider") public void ValidPasswordTest(String[] password) { for(String temp : password){ boolean valid = passwordValidator.validate(temp); System.out.println("Password is valid : " + temp + " , " + valid); Assert.assertEquals(true, valid); } } @Test(dataProvider = "InvalidPasswordProvider", dependsOnMethods="ValidPasswordTest") public void InValidPasswordTest(String[] password) { for(String temp : password){ boolean valid = passwordValidator.validate(temp); System.out.println("Password is valid : " + temp + " , " + valid); Assert.assertEquals(false, valid); } } }
Unit Test – Result
Password is valid : mkyong1A@ , true
Password is valid : mkYOn12$ , true
Password is valid : mY1A@ , false
Password is valid : mkyong12@ , false
Password is valid : mkyoNg12* , false
Password is valid : mkyonG$$ , false
Password is valid : MKYONG12$ , false
PASSED: ValidPasswordTest([Ljava.lang.String;@1d4c61c)
PASSED: InValidPasswordTest([Ljava.lang.String;@116471f)
===============================================
com.mkyong.regex.PasswordValidatorTest
Tests run: 2, Failures: 0, Skips: 0
===============================================
===============================================
mkyong
Total tests run: 2, Failures: 0, Skips: 0
===============================================Want to learn more about regular expression? Highly recommend this best and classic book – “Mastering Regular Expression”






Thanks for this! Saved me a lot of time. Much appreciated Mkyong!
Thank you, you saved me ALOT of time ?
yeah, you are right. this is a very good articles.i have learned so many things from
[...] Validate password with regular expression [...]
Using this string as test data: “X@CpJ[8~”
It would return true, even though the characters ‘[‘ and ‘~’ are not allowed.
According to the regex these characters are allowed, but not required.
This regEx fails for April123
Why is that so?
According to pattern it should not pass right?
Thanks! Very helpful. I slept through the regex stuff in class… :-(
Good night,
I’m not able to pass parameters to the regular expression for example:
“((?=.*\\d{3})(?=.*[a-z]{5})(?=.*[A-Z]{2})(?=.*[@#$%]{2}).{4,20})”;
((?=.*\\d{3}) == Change de number 3 to a variable .
Thanks a lot,
[...] The above regex pattern is required 6 to 20 characters string with at least one digit, one upper case letter, one lower case letter and one special symbol (“@#$%”). This is strong and complex enough for a password validation, see this password validation with regular expression. [...]
[...] ==> See the explanation and example here [...]