Checking the strength of a password (how to check conditions)

Solution 1:

Holá
The best approach is using regular expression search
Here is the function I am currently using

def password_check(password):
    """
    Verify the strength of 'password'
    Returns a dict indicating the wrong criteria
    A password is considered strong if:
        8 characters length or more
        1 digit or more
        1 symbol or more
        1 uppercase letter or more
        1 lowercase letter or more
    """

    # calculating the length
    length_error = len(password) < 8

    # searching for digits
    digit_error = re.search(r"\d", password) is None

    # searching for uppercase
    uppercase_error = re.search(r"[A-Z]", password) is None

    # searching for lowercase
    lowercase_error = re.search(r"[a-z]", password) is None

    # searching for symbols
    symbol_error = re.search(r"[ !#$%&'()*+,-./[\\\]^_`{|}~"+r'"]', password) is None

    # overall result
    password_ok = not ( length_error or digit_error or uppercase_error or lowercase_error or symbol_error )

    return {
        'password_ok' : password_ok,
        'length_error' : length_error,
        'digit_error' : digit_error,
        'uppercase_error' : uppercase_error,
        'lowercase_error' : lowercase_error,
        'symbol_error' : symbol_error,
    }

EDIT:
Fallowing a suggestion of Lukasz here is an update to the especial symbol condition verification

symbol_error = re.search(r"\W", password) is None

Solution 2:

password.isalnum() returns a boolean, so password.isalnum()==password will always be False.

Just omit the ==password part:

if password.lower()== password or password.upper()==password or password.isalnum():
    # ...

Next, it can never be both all upper and lower, or all upper and numbers or all lower and all numbers, so the second condition (medium) is impossible. Perhaps you should look for the presence of some uppercase, lowercase and digits instead?

However, first another problem to address. You are testing if the password is alphanumeric, consisting of just characters and/or numbers. If you want to test for just numbers, use .isdigit().

You may want to familiarize yourself with the string methods. There are handy .islower() and .isupper() methods available that you might want to try out, for example:

>>> 'abc'.islower()
True
>>> 'abc123'.islower()
True
>>> 'Abc123'.islower()
False
>>> 'ABC'.isupper()
True
>>> 'ABC123'.isupper()
True
>>> 'Abc123'.isupper()
False

These are faster and less verbose that using password.upper() == password, the following will test the same:

if password.isupper() or password.islower() or password.isdigit():
    # very weak indeed

Next trick you want to learn is to loop over a string, so you can test individual characters:

>>> [c.isdigit() for c in 'abc123']
[False, False, False, True, True, True]

If you combine that with the any() function, you can test if there are some characters that are numbers:

>>> any(c.isdigit() for c in 'abc123')
True
>>> any(c.isdigit() for c in 'abc')
False

I think you'll find those tricks handy when testing for password strengths.