regex password validation

This should do it...

^(?=.*[0-9].*[0-9])[a-zA-Z0-9]{8,}$

The only change I made is adding this (?=.*[0-9].*[0-9]) which is a positive lookahead that will try to find the first 2 digits within the password. If it's satisfied, then the regular expression will proceed as usual.

Now, I just thought I'd point out that your regular expression will disallow special characters (punctuation and such). In practice, some people like to enter weird characters like this in their passwords.

So you might consider something more like this...

^(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9]).{8,}$

This will allow special characters while also ensuring at least one capital letter, one lower case letter, and one number exist in the password. This is just an example of a strong password regular expression I wrote awhile back, and you could certainly relax those restrictions a bit if you so desired.

Match it twice:

s.matches("^[a-zA-Z0-9]{8,}$");
s.matches("[0-9].*[0-9]");

Use the results like this:

if ( s.matches("^[a-zA-Z0-9]{8,}$") && s.matches("[0-9].*[0-9]") ) {
    # password is valid
}

Try this: (?:^|\s+)(\w{8,})(?<=(.*\d.*\d.*))(?:\s+|$)

Modified to allow for more than 8 chars from: http://social.msdn.microsoft.com/Forums/en/regexp/thread/8e0ced1f-8ddc-4583-89de-e29b4c4dc726

I really don't see any good reason to check the length of a string with a regex - keep it simple is always a good idea, but especially with regexes the temptation to throw everything into a completely unreadable string (that may have some strange edgecases) is pretty tempting.

Just use the length method for the length and something like "\w*?\d\w*?\d\w*" Note that .* is greedy so don't forget the ? after it. \d signifies a digit in java - I don't think there are any cases with unicode you'd miss with [0-9] - but better safe than sorry

Edited to use \w instead of . (only word characters i.e. [a-zA-Z_0-9])

How about this?

private Pattern p1  = Pattern.compile("^\\w{8,}$");
private Pattern p2  = Pattern.compile("\\d+(.*)?\\d+");

private boolean match(String s) {
    return p1.matcher(s).find() && p2.matcher(s).find();
}

@Test
public void testPassword() {
    assertTrue("length at least 8", match("2aaaaaa2"));
    assertTrue("length at least 8", match("aaaaaaa22"));
    assertTrue("length at least 8", match("22aaaaaaa"));
    assertTrue("length at least 8", match("aa2aa2aaa"));

    assertFalse("length less than 8", match("2aa2aaa"));
    assertFalse("one digit", match("aa2aaaaa"));
    assertFalse("no digits", match("aaaaaaaa"));
}

edit

Don't use match, but find. ( read the documentation )

The matches method attempts to match the entire input sequence against the pattern.>

That's why \d.*\d doesn't work with a2a2a

The find method scans the input sequence looking for the next subsequence that matches the pattern.

This is what you need.

You just have to test if there is are two numbers with anything in between \d.*\d :

import java.util.regex.*;
class TwoDigits { 
    public static void main( String ... args ) { 
        Pattern pattern = Pattern.compile("\\d.*\\d");
        Matcher matcher = pattern.matcher( args[0]  );  
        System.out.println("Matched ( found ) ? = " + matcher.find());
    }
}

But perhaps I'm missing something here, why don't your try it and tell us where it fails.

C:\java>java TwoDigits ""
Matched ( found ) ? = false

C:\java>java TwoDigits "a"
Matched ( found ) ? = false

C:\java>java TwoDigits "1a1"
Matched ( found ) ? = true

C:\java>java TwoDigits "1a"
Matched ( found ) ? = false

C:\java>java TwoDigits "a1a"
Matched ( found ) ? = false

C:\java>java TwoDigits "a1a1"
Matched ( found ) ? = true

C:\java>java TwoDigits "2a2"
Matched ( found ) ? = true

C:\java>java TwoDigits "2aaa2"
Matched ( found ) ? = true

C:\java>java TwoDigits "2aaaaaaaaaaaaaaa2"
Matched ( found ) ? = true

C:\java>java TwoDigits "2aaaaaaaaaaaaaaa"
Matched ( found ) ? = false

C:\java>java TwoDigits "2aaaaaa2aaaaaaaaaa"
Matched ( found ) ? = true

C:\java>java TwoDigits "a3aaaaa2aaaaaaaaaa"
Matched ( found ) ? = true