Excuse if this is a stupid question. I'm doing a web design subject at uni and am pletely stuck. I have to validate a password using Javascript to ensure it has and uppsercase, lowercase, numerical character, and at least 4 characters.

This is the code I have, it's giving me alerts to say I HAVEN'T included the characters, but when I HAVE included them I'm still getting the alert. Any help appreciated.

var y = document.forms["loginDetails"]["password"].value;
if (y.length < 4) {
    alert("Your password needs a minimum of four characters")
}
if (y.search[/a-z/i] < 1) {
    alert("Your password needs a lower case letter")
}
if (y.search[/A-Z/i] < 1) {
    alert("Your password needs an uppser case letter")
}
if (y.search[/0-9/] < 1) {
    alert("Your password needs a number")
    return false;
}

Excuse if this is a stupid question. I'm doing a web design subject at uni and am pletely stuck. I have to validate a password using Javascript to ensure it has and uppsercase, lowercase, numerical character, and at least 4 characters.

This is the code I have, it's giving me alerts to say I HAVEN'T included the characters, but when I HAVE included them I'm still getting the alert. Any help appreciated.

var y = document.forms["loginDetails"]["password"].value;
if (y.length < 4) {
    alert("Your password needs a minimum of four characters")
}
if (y.search[/a-z/i] < 1) {
    alert("Your password needs a lower case letter")
}
if (y.search[/A-Z/i] < 1) {
    alert("Your password needs an uppser case letter")
}
if (y.search[/0-9/] < 1) {
    alert("Your password needs a number")
    return false;
}

• javascript

• I thing that you are missing [] in your regexp. It should be e.g. /[A-Z]/ – lopisan Commented May 4, 2013 at 17:42
• 1 I think the issue has been pointed out, but I'll also note that this is an annoying and pointless way to enforce good passwords. At the very least, reduce the number of arbitrary restrictions imposed as the length increases (for example if I want to set hitheremynameisjohnny, that's far more secure than P4ss) – Dave Commented May 4, 2013 at 17:47
• 1 Oh and you're searching for an upper/lower case character, but you set the i flag, which means ignore case. – Dave Commented May 4, 2013 at 17:48
• One note with regard to @Dave 's ment: the password should also be validated on the server-side. This code is more for client usability purposes. – Aiias Commented May 4, 2013 at 18:10

6 Answers 6

There were a few issues with your code:

1. String.search() returns -1 if the regular expression is not found. Checking against < 1 will still return true incorrectly if the string is found at the 0th (first) character.
2. String.search() is a function and needs to be called with parentheses ( ) surrounding the arguments, not brackets [ ].
3. You do not want to perform case-insensitive searches in your regular expressions, so remove the /i option.
4. Try keeping track of whether or not there was an error in another variable. Then if any of the cases generated an error, you can return false.

Try this:

var error = false;
var message = '';
if (y.length < 4) {
  message += "Your password needs a minimum of four characters. ";
  error = true;
}
if (y.search(/[a-z]/) == -1) {
  message += "Your password needs at least one lower case letter. ";
  error = true;
}
if (y.search(/[A-Z]/) == -1) {
  message += "Your password needs at least one upper case letter. ";
  error = true;
}
if (y.search (/[0-9]/) == -1) {
  message += "Your password needs a number.";
  error = true;
}
if (error) {
  alert(message);
  return false;
}

Your code had several errors

• parision should be <0 not <1 (search returns negative value when regexp is not found)
• /i in regexp (case insensitive - not appropriate when trying to figure out upper/lower case characters)
• call of search function was wrong (usage of [] instead of () )
• in regexp [] was missing ([] in regexp means one character from given range, so [a-z] will match each lowercase character whereas a-z will match just string 'a-z')

It should look like:

if (y.length < 4) {
  alert("Your password needs a minimum of four characters")
} else if (y.search(/[a-z]/) < 0) {
  alert("Your password needs a lower case letter")
} else if(y.search(/[A-Z]/) < 0) {
  alert("Your password needs an uppser case letter")
} else  if (y.search(/[0-9]/) < 0) {
  alert("Your password needs a number")
} else {
    // Pass is OK
}

Note that "search" is a function, so you have to call it like y.search(), not with [] brackets (those are used to access a member. y"search" would have the same effect, but search[] is not ok, because it is not an array

Try changing your code this way by:

• Adding return false; to each of the failure statement.
• Changing the search() function syntax.
• You don't need to use /i as it doesn't check the cases.

Code

var y = document.forms["loginDetails"]["password"].value;
if (y.length < 4) {
    alert("Your password needs a minimum of four characters")
    return false;
}
if (y.search(/[a-z]/) < 1) {
    alert("Your password needs a lower case letter")
    return false;
}
if (y.search(/[A-Z]/) < 1) {
    alert("Your password needs an uppser case letter")
    return false;
}
if (y.search(/[0-9]/) < 1) {
    alert("Your password needs a number")
    return false;
}

the main problem is that you're using the 'i' modifier, what tells the regexp to be case insensitive, try without this modifier.

To improve the user experience I use one error message, so, yo could use this code:

if(/[a-z]+/.test(s) && /[A-Z]+/.test(s) && /\d+/.test(s) && s.length >= 4)
  return true;

alert("Your password needs Upper and lower case letters, numbers and a minimum four chars");
return false;

You could try this:

var y = document.forms["loginDetails"]["password"].value;

if (y.length < 4) {
    alert("Password should contain minimum four characters");
    return false;
} 

var pwd=/^(?=.*[a-z])/;
var pwd1=/^(?=.*[A-Z])/;
var pwd2=/^(?=.*[0-9])/;

if (pwd.test(y) == false) {
    alert("Password Should contain atleast One lowerCase letter");
    return false;
}

if (pwd1.test(y) == false) {
    alert("Password Should contain atleast One UpperCase letter");
    return false;
}
if (pwd2.test(y) == false) {
    alert("Password Should contain atleast One Number");
    return false;
}

Or, you could do the same in a single line as well :

var pwd=/^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])/;
if (pwd.test(y) == false) {
    alert("Password Should contain atleast One Number, One UpperCase and a lowercase letter");   
    return false;
}