We have new rules with for our password validation.  Which used to be fairly simple.  Now this doesn't seem to difficult but with my inexperience with regular expressions I am trying to out how to get this one to pass. 

 I am using javascript to do client side processing on the password before we allow it through when the user changes the password.  So the rule I am getting stuck on is the following:

• Must contain at least 2 numbers and/or special characters
• Special characters include % - _ ! +

Let me add that we do have more rules to the password and I am checking all of the following rules before I am getting to this one.  And those rules include:

• 8 characters minimum
• 15 characters maximum
• First character must be alpha

Any help with this will be greatly appreciated!

Thanks!

Jeremy Wickham
 

var re = /(?=.*[\d%_!+-].*[\d%_!+-]).*/;

For the 3 additional rules I missed on my first read of the question:

var re = /(?=^[A-Za-z].{7,14}$)(?=.*[\d%_!+-].*[\d%_!+-]).*/;

My suggestion would be:

^(?=(.*?[\d%_!+-]){2})[a-z].{7,14}$

This assumes that the 'ignore case' option is set. If you want to, you can change the '[a-z]' to '[a-zA-Z]' to make just this part case insensitive. Also, this does all pf the tests you mention in the single regex.

If the set of "special characters" is to be altered, then simply change the character set within the lookahead.

Note that the final quantifier has the min and max values 1 less than those you specified because of the leading alpha check.

I have not added any quoting etc that may be needed to make this suitable for javascript.

Susan