Password validation Regular expression

问题:

I have a password validation like the following rules

1. Should contains at most 15 chars and 8 chars at least
2. Password should contain 2 numeral character
3. There is no importance where to put the two numeral chars in start or end even if they anywhere in the password

回答1:

^(?=\D*\d\D*\d).{8,15}$

回答2:

The best you can do is present your user with an estimate of the strength of their password and let them shoot their own foot if they wish.

Any scheme to force people to make good passwords is doomed by the ability of people to use post-it notes.