About two years ago, I wrote a little function to calculate the complexity of a password based on the usage of character classes. My goal was to not force people into adding '123!' to their password just to use all character classes, but instead allow pure character passwords with an equivalent complexity. That way the user can choose if wants to use an 8 character password with upper case, lower case and numbers or a much longer password with lower case letters only (or something in between).
The function is far from perfect as it was just the first implementation of that idea and never run in production. But I think as a base for a discussion it should be good enough.
function passwordComplexEnough($password){
$chars=0;
if(preg_match('/\p{Lu}+/', $password) === 1){ // letter upper case
$chars+=26;
}
if(preg_match('/\p{Ll}+/', $password) === 1){ // letter lower case
$chars+=26;
}
if(preg_match('/\p{Nd}+/', $password) === 1){ // decimal digit number
$chars+=10;
}
if(preg_match('/\p{S}+/', $password) === 1){ // symbol
// seems pessimistic but reasonable
$chars+=10;
}
$len = mb_strlen($password);
$complexity = pow($chars, $len);
// 62^8 (62 chars and length 8 as minimum complexity)
return ($complexity >= 218340105584896);
}
The function is far from perfect as it was just the first implementation of that idea and never run in production. But I think as a base for a discussion it should be good enough.
What do you think of this approach?