For the best user experience, you’ll probably want to use multiple regular expressions, to ensure that you can provide helpful error responses to the user when their password doesn’t meet requirements.

Length Requirements

If this matches, the password is between 8 and 40 characters.

Regex: ^.{8,40}$

Uppercase Letters

If this matches, the password contains an uppercase letter.

Regex: [A-Z]

Lowercase Letters

If this matches, the password contains a lowercase letter. Regex: [a-z]

Numbers

If this matches, the password contains a number.

Regex: [0-9]

Special Characters

If this matches, the password contains a special character.

Regex: [ !"#$%&'()*+,\-./:;<=>?@[\\\]^_`{|}~]