You're almost there; it's simple .* at the end, which ignores your โno spaces / special charactersโ rules, and the look (?=.\s) wrong (you probably meant (?!.*\s) or (?=\S*$) )).
But you still don't need this lookahead, because you can simply specify which characters are allowed (and also apply the "8 characters minimum" rule):
^(?=.*[az])(?=.*[AZ])(?=.*\d)[A-Za-z\d]{8,}$
But why do you want users to not use alphanumeric characters in their passwords?
source share