# Strong Password Detection in Python

This is a problem from "Automate the boring stuff".

Write a function that uses regular expressions to make sure the password string it is passed is strong. A strong password is defined as one that is at least eight characters long, contains both uppercase and lowercase characters, and has at least one digit. You may need to test the string against multiple regex patterns to validate its strength.

How to improve this code?

#! /usr/bin/python3

import re

if re.search('[A-Z]', password): #atleast one uppercase character
return True
return False

if re.search('[a-z]', password): #atleast one lowercase character
return True
return False

if re.search('[0-9]', password): #atleast one digit
return True
return False

#atleast 8 character long
else:


• Please give some feedback to the authors of "Automate the boring stuff" that their task is misguided. Hopefully they will remove it then. – Roland Illig Jul 6 '19 at 15:05
• obXKCD – Barmar Jul 6 '19 at 17:09
• Aside: Obligatory Security.SE question about above XKCD. Also an article about how NIST changed their recommendations on the matter as well. In brief, this mindset about password "strength" is rapidly being outdated. Your question is fine, though, since you're given a problem and asking for a review of the solution. Just realize that this is a toy problem and not something that you should be implementing in production code. (Note that password security is more often done wrong than right, as well.) – jpmc26 Jul 7 '19 at 2:44
• @jpmc26 Welp, it's better to have such a check than no check at all. Otherwise 2-character passwords are allowed too. – Mast Jul 7 '19 at 18:49
• @Mast Have a length check. That's the minimum. If you're going to do more, filter out common passwords (like at least the 10000 most common) and maybe some patterns or keywords that make the password easier to guess. Put visible recommendations for random passwords and 2-factor auth in your app. The kinds of requirements here actually reduce the password space and encourage poor password choice. – jpmc26 Jul 8 '19 at 5:33

I'm submitting this as a different answer because it goes in a different direction from my previous one, eliminating the bool cast as well as individual functions. You can simply define a tuple of regular expressions and apply all.

rexes = ('[A-Z]', '[a-z]', '[0-9]')
# ...

• While it doesn't use regexps just thought it worth pointing out an alternative using unicodedata.category. You categorise each letter and then check each of the types you want is present (lower case, upper case and digit), something along the lines of: if len(password) >= 8 and {'Ll', 'Lu', 'Nd'}.issubset(unicodedata.category(ch) for ch in password)... – Jon Clements Jul 6 '19 at 17:34
• @JonClements True, and that approach is probably more friendly to i18n – Reinderien Jul 6 '19 at 23:09

First, please note that this security measure has been thoroughly debunked (although the reasons why are complex and psychological). Any code resulting from this exercise is therefore by the standards of the security community following an anti-pattern, and should not be used no matter how polished.

That said:

• Rather than the

if something:
return True
return False


a more readable pattern is simply return something.

• This code would be more scriptable if it either took passwords as arguments (using argparse) or read one password per line from standard input.
• Another way to make this more scriptable is to use the really common

if __name__ == "__main__":
sys.exit(main())


pattern.

Firstly: what @l0b0 said. This is fundamentally misguided, and you're better off doing an actual entropy measurement.

As for your check functions, you can rewrite them as:

def uppercase_check(password: str) -> bool:


Note that it uses proper type-hinting, and doesn't need an if.

• You preform multiple function calls which are all very related. You can cram each of the regex checks into one if statement.
• You should use a main guard to ensure that the code is only running if this file is the main one, so that any programs importing this file don't have any issues.
• You should also use docstrings. These allow potential documentation to display information about what the methods(s) are supposed to accomplish.
• Using condensed if statements can clean up the messiness of having if: ... else: ... when there is just one statement being executed in each block.

Here is the updated code:

#! /usr/bin/python3

import re


• return False if not isn't the best way to go about this. Instead, cast to bool. – Reinderien Jul 6 '19 at 13:51
• You could also refrain from not using less fewer negations in your code. A much more natural way to express the original task is return has_digits and has_upper and has_lower. – Roland Illig Jul 6 '19 at 15:02
• Use some vertical whitespace in that very long boolean condition. Might even make sense to switch to an any call. – jpmc26 Jul 7 '19 at 2:59