using regex for password validation

[Grant Edwards]

On 2020-12-23, Mats Wichmann <mats at wichmann.us> wrote:

> Telling someone the password they tried to propose doesn't meet the 
> policy isn't performance sensitive, since it is a human-interactive 
> process, so it's okay to be a little slower and a lot clearer (that's 
> not even a Python issue!)

You're far, far better off writing a function that tests each rule
separately, so that you can tell the user _why_ the password isn't
allowed. If you use a regex, it's just pass/fail. The user won't have
any idea how to fix the problem.

-- 
Grant Edwards               grant.b.edwards        Yow! With YOU, I can be
                                  at               MYSELF ...  We don't NEED
                              gmail.com            Dan Rather ...