There has been some discussion of late about passwords vs. pass phrases and how long a password should be. I won't add to the mix except to say that I am a believer when it comes to complex passwords. Heck, my 4 year old is required to use a userid and password to log into his session on his computer :-)
I've recently been working on some things that require me to make sure that the passwords that are used are sufficiently complex. Here is what I am using right now:
- Must be at least 10 characters
- Must contain at least one one lower case letter, one upper case letter, one digit and one special character
- Valid special characters are - @#$%^&+=
The regex that I am using to enforce this is:
^.*(?=.{10,})(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[@#$%^&+=]).*$
As you can see in the regex, the list of special characters is configurable...