For password Validation using regex my requirement is to
I was using the regex:
var reg = /(?=.*[a-z]+.*)(?=.*[A-Z]+.*)(?=.*\d+.*)(?=.*[-[!“#$%&'()*+,-./:;<=>?@[\]^_`{|}~]+.*)(?!.*(.)\1\1\1.*)(?!.*(.{3}).*\2.*).{8,256}$/;
But it is not restricting the sequential character or numbers. please let me know what other expression I can use
A couple of comments:
If a password may not contain more than three (3) repeating characters or numbers (which I interpret as meaning anywhere within the password), then it certainly could not have more than three sequential characters or numbers. So the last condition is superfluous. Also, one generally uses the word "character" to describe any possible thing that can be entered so in the phrase "characters or numbers" the word "numbers" seems to be redundant. Is it possible you meant "alpha characters"? I am assuming you meant arbitrary characters.
I believe you specified your special characters incorrectly. Within the [ and ] you need to place the - as the last character or it will be interpreted as a range specification. And, of course, the ] character needs to be escaped.
Try:
^(?=[^a-z]*[a-z])(?=[^A-Z]*[A-Z])(?=\D*\d)(?=[^!“#$%&'()*+,./:;<=>?@\[\]^_`{|}~-]*[!“#$%&'()*+,./:;<=>?@[\]^_`{|}~-])(?!.*(.).*\1.*\1.*\1).+$
Explanation
If you want to ensure that the input contains, for example, at least one lower case letter, then I thin it is more efficient to specify the lookahead assertion as:
(?=[^a-z]*[a-z])
Here you are specifically scanning 0 or more non-lower-case letters until you find a single lower-case letter and then you can quit. The same technique is used for the upper-case, digit and special-character requirements.
To ensure the same character is not repeated more than 3 times:
(?!.*(.).*\1.*\1.*\1)
And finally you want the password to have at least one character (you posed no minimum size):
^.+$ (lookahead assertions omitted)
I would set a minimum and maximum size using the following as the very first lookahead assertion:
^(?=.{8,16}$)etc.
where I used 8 and 16 as the minimum and maximum lengths respectively. The reason for doing this as the first lookahead assertion is because the lookahead assertion used to verify that no character occurs more than 3 times gets increasingly expensive as the input string length increases so it's best to check the string length before doing any other checks.