Implementing Password Strength Validation in Java

Establishing Policy Constraints

Secure authentication flows require strict credential evaluation. A standard policy enforces a combinaiton of character classes alongside specific length boundaries to prevent trivial guessing attacks. The following constraints are applied:

  • Total length restricted between 6 and 20 characters
  • Presence of at least one uppercase Latin letter (A-Z)
  • Presence of at least one lowercase Latin letter (a-z)
  • Presence of at least one numeric digit (0-9)
  • Presence of at least one non-alphanumeric symbol

Validation Logic

Instead of chaining multiple independent string matching calls, a single compiled regular expression utilizing positive lookaheads evaluates all conditions simultaneously. This approach reduces overhead and centralizes the rule set.

public class CredentialEvaluator {
  private static final String VALIDATION_RULE = 
      "^(?=.*[A-Z])(?=.*[a-z])(?=.*\\d)(?=.*[^A-Za-z0-9]).{6,20}$";
  private static final java.util.regex.Pattern COMPILED_PATTERN = 
      java.util.regex.Pattern.compile(VALIDATION_RULE);

  public boolean assessStrength(String candidate) {
      if (candidate == null || candidate.isEmpty()) {
          return false;
      }
      return COMPILED_PATTERN.matcher(candidate).find();
  }
}

The pattern operates as follows:

  • ^ and $ anchor the match to the start and end of the string.
  • (?=.*[A-Z]) ensures a uppercase character exists anywhere in the sequence.
  • (?=.*[a-z]) verifies the presence of a lowercase character.
  • (?=.*\\d) confirms at least one numeric value.
  • (?=.*[^A-Za-z0-9]) validates that a special symbol is included.
  • .{6,20} enforces the exact character count boundaries.

Execution and Testing

The validator can be exercised using a driver method that processes a series of test inputs, logging the pass or fail status for each scenario.

public static void executeDiagnostics() {
  CredentialEvaluator evaluator = new CredentialEvaluator();
  String[] samples = {
      "ComplexPwd9@",
      "short",
      "ONLYCAPSAND1!",
      "missing_symbols1",
      "Valid1x#"
  };

  for (String item : samples) {
      boolean isAcceptable = evaluator.assessStrength(item);
      System.out.println(String.format("[%s] Result: %s", item, isAcceptable ? "VALID" : "INVALID"));
  }
}

Tags: java regular-expressions password-validation security-patterns input-sanitization

Posted on Fri, 23 Oct 2026 16:57:15 +0000 by codersrini