why does this regex not make special characters compulsary

Question

I have the following regex:

(?=^.{7,14}$)(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[!@#$%^&*()_+}{":;'?\/>.<,])(?!.*\s).*$

It's meant to match and enforce the following password policy:

• One Capital
• One lower case
• One digit
• one special char i.e. @

However, it allows a password without any special chars.

Answer 1

The problem comes from the html entities inside the character class (a character class is a set of characters, you can't put strings inside), consequence, strings that contain q,u,o,t,e,g or l succeed.

Instead you can use:

^(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[!-@_{}])\S{7,14}$

(The character class for special characters is shorten using ranges and the ascii table)