Password validator using regular expressions

Question

I wanted to learn some regex, but learning regex is super boring so I decided to write a password validator that will validate a password with regular expressions.

How it works:

• You enter a password that has no echo thanks to the getpass library
• The password is run against five different validations such as, upper case, lower case, special character, and digits. These are done by using the re (regex) library.
• If the password does not pass one of the validations it will output a random password using the random library that will match the given guidelines.

What I would like to know is:

• Are there better ways to create a random string?
• Are there better regular expressions I could use to verify that password?

Source:

import getpass
import re
import random


def random_password(length=3):

    """ Create a a random password to display if the
       primary validation fails. """

    valid_upcase = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'
    valid_lowcase = 'abcdefghijklmnopqrstuvwxyz'
    valid_specs = '!$@&'
    valid_digits = '1234567890'

    return ''.join((random.choice(valid_upcase) + random.choice(valid_lowcase) + random.choice(valid_specs) + random.choice(valid_digits) for i in xrange(length)))


def length_error(password):
    """ Validate that the password is over 8 characters
       and no more than 20 characters. """

    if 8 > len(password) :
        return False
    else:
        return True


def lower_error(password):

    """ Confirm that the password contains at least one
       lower case letter """

    if re.search(r"[a-z{1,9}]", password) is None:
        return False
    else:
        return True


def symbol_error(password):

    """ Make sure that the password contains at least one
       of the following special characters: ! @ $ & """

    if re.search(r"[!@$&{1,5}]", password) is None:
        return False
    else:
        return True


def upcase_error(password):

    """ Confirm that the password contains at least one
       upper case character. """

    if re.search(r"[A-Z{1,5}]", password) is None:
        return False
    else:
        return True


def digit_error(password):

    """ Confirm that the password contains at least one
       digit. """

    if re.search(r"\d{1,5}", password) is None:
        return False
    else:
        return True


def prompt(info):

    """ Get the password without echo. """

    return getpass.getpass(info) 
    #return raw_input(info)  # # Uncomment this for echo


def validate_password(password):

    """ Where the validation occurs, if the password does
       not pass one of the following tests, it will output
       a random string that does pass the test. """

    if lower_error(password) is False or upcase_error(password) is False:
        print "Password did not match the uppercase or lowercase requirements."
        print "Random password to use: {}".format(random_password())
    elif digit_error(password) is False or symbol_error(password) is False:
        print "Password did not match the integer and special character requirements."
        print "Random password to use: {}".format(random_password())
    elif length_error(password) is False:
        print "Password did not meet the length requirements."
        print "Password must be over 8 characters and no more then 20 characters"
        print "Random password to use: {}".format(random_password())
    else:
        print "Password validated successfully."


def obtain_password():

    """ Main method. """

    password_to_verify = prompt("Enter password: ")
    validate_password(password_to_verify)


if __name__ == '__main__':
    obtain_password()

Answer 1

(Note: Python is not my main language, and this is my first answer on Code Review)

Looks alright, I can't see any obvious holes in the regex. Tried it a few times myself, worked as expected.

I don't really have a good answer for you "random string" question, but for:

• Are there better regular expressions I could use to verify that password?

Well, I think you could take out the curly brackets out on them. For instance, when you're matching any lower case letter, at least once, you have:

if re.search(r"[a-z{1,9}]", password) is None:

Since you only want to know if one exists, you don't need the {1,9}. So, unless there's some strangeness with re.search that I don't know about, you could replace [a-z{1,9}] with just [a-z]. Ditto for the other validation functions.

Now, I'm not 100% certain with this, but it seems you could return either None or a number from your validation functions, and test whether it's equal to None in validate_password(). Like this:

def lower_error(password):
    return re.search(r"[a-z]", password)

def symbol_error(password):
    return re.search(r"[!@$&]", password)

def upcase_error(password):
    return re.search(r"[A-Z]", password)

def digit_error(password):
    return re.search(r"\d", password)

Now lower_error() etc return None, or a number.

def validate_password(password):
    if lower_error(password) is None or upcase_error(password) is None:
    ...
    elif digit_error(password) is None or symbol_error(password) is None:
    ...

I was a bit worried about 0 being equal to None, but typing 0 is None into the Python REPL says False.

EDIT: By the way, just noticed length_error() only checks if it's less than 8 characters, not that it's under 20.