Regex to validate a strong password in JavaScript and PHP

A password regular expression is there to check the shape of a password, and to make sure the one supplied is strong enough to stand up to brute-force attacks from bots.

A regular expression for a strong password

The regular expression below checks that a password is:

• At least 8 characters long. Adjust that by changing {8,}

• Made of at least one uppercase letter. Drop the condition by removing (?=.* ?[A-Z])

• Made of at least one lowercase letter. Drop the condition by removing (?=.* ?[a-z])

• Made of at least one digit. Drop the condition by removing (?=.* ?[0-9])

• Made of at least one special character. Drop the condition by removing (?=.* ?[#?!@$%^&*-])

/^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[#?!@$%^&*-]).{8,}$/

JavaScript version

The function takes the password as a parameter and compares it against the regular expression. If nothing matches, validation fails and the function returns false, if the match succeeds, the password has the right shape and the function returns true. Here is the JavaScript function that validates the password

/**
 * Validate a password
 *
 * If the password is not strong enough, return false
 *
 * @param mdp
 * @return Boolean
 */
function validateMDP(mdp){
    var Reg = new RegExp(/^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[#?!@$%^&*-]).{8,}$/);
    return Reg.test(mdp);
}

How to use the JavaScript function

The simplest way to use it is inside an IF statement, as below.

if(validateMDP(mdp)){
     alert("Mot de passe  valide");
} else {
     alert("Mot de passe invalide");
}

See the Pen
Valider un email avec une expression régulière by Damien Flandrin (@dam62500)
on CodePen.0

PHP version

/*
 * validate password
 * @param $mdp
 */
 function isValidMDP($mdp)
 {
   return preg_match('/^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[#?!@$%^&*-]).{8,}$/', $mdp)
 }

HTML version

You can also check the field in HTML, upstream of the PHP and JavaScript validation, with the pattern attribute: it lets you use CSS to show whether the password matches the regular expression.

 <input
      name="mdp"
      type="text"
      pattern="(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[#?!@$%^&*-]).{8,}"
     />

See the Pen
Vérifier une date avec une expression régulière en HTML by Damien Flandrin (@dam62500)
on CodePen.0