I agree with @Russell, the function is the best choice for password verification. And it's hard to imagine that one Regex handles all of these cases. I think you will have to check each in turn.
In an individual expression of a Regex expression:
.{8} matches at least 8 characters[az] matches one lowercase character[az] matches one uppercase character[0-9] matches the digit
As stated, they would only be useful for client-side validation before the server performs an in-depth validation.
source share