Password validation php regex

I would first try and find two numbers, using non-regex (or preg_match_all('[0-9]', ...) >= 2, then validating against:

^[!@#$%*a-zA-Z0-9]{8,}$

This should be faster and easier to understand. To do it using only regex sounds you need lookahead which basically scans the expression twice afaik, though I'm not sure of the PHP internals on that one.

Be prepared for a lot of complaints about passwords not being accepted. I personally have a large subset of passwords that wouldn't validate against those restrictions. Also nonsensical passwords like 12345678 would validate, or even 11111111, but not f4#f@faASvCXZr$%%zcorrecthorsebatterystaple.

Full Strong Password Validation With PHP

• Min 8 chars long
• Min One Digit
• Min One Uppercase
• Min One Lower Case
• Min One Special Chars

/^\S*(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=\S*[\W])[a-zA-Z\d]{8,}\S*$/

Demo here

This will do the trick. Look ahead is nice for this...

//Matches alphanumeric or specified special characters and requires at least 2 digits

/^(?=.*\d.*\d)[0-9A-Za-z!@#$%]{4,20}$/

BONUS requires one of each: uppercase, lowercase, digit, and specified special characters

 /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d.*\d)(?=.*[!@#$%])[0-9A-Za-z!@#$%]{4,20}$/

EXPLAINED in pieces below

Look ahead/require for a lower case:

(?=.*[a-z])

Look ahead/require an uppercase:

(?=.*[A-Z])

Look ahead/require two digit:

(?=.*\d.*\d)

Look ahead/require only specified special chars:

(?=.*[!@#$%])

Entire password must contain a minimum of 4 and maximum of 20 only alpha numeric and specified special chars:

[0-9A-Za-z!@#$%]{4,20}

if(preg_match('/[!@#$%*a-zA-Z0-9]{8,}/',$password) && preg_match_all('/[0-9]/',$password) >= 2)
{
    // do
}