You must use two separate validators, one for checking the length and the other for checking the minimum required characters (this way you will get two separate error messages for each check).
Example:
<asp:TextBox ID="MyPasswordField" runat="server" TextMode="Password"></asp:TextBox> <asp:RegularExpressionValidator Display="Dynamic" ControlToValidate="MyPasswordField" ID="MyPassordMinLengthValidator" ValidationExpression="^[\s\S]{8,}$" runat="server" ErrorMessage="Password must be at least 8 characters long."></asp:RegularExpressionValidator> <asp:RegularExpressionValidator Display="Dynamic" ControlToValidate="MyPasswordField" ID="MyPassordRequiredCharacterValidator" ValidationExpression="^(?=.*[az])(?=.*[AZ])(?=.*\d).+$" runat="server" ErrorMessage="Must contain at least one uppercase letter, one lowercase letter, and one number."></asp:RegularExpressionValidator>
If you also need to check the password for the maximum length, you can change the regular expression for the first validator as follows:
<asp:RegularExpressionValidator Display="Dynamic" ControlToValidate="MyPasswordField" ID="MyPassordMinMaxLengthValidator" ValidationExpression="^[\s\S]{8,40}$" runat="server" ErrorMessage="Password must be between 8 and 40 characters long."></asp:RegularExpressionValidator>
If you need to verify that at least one special character is present, you can use this regular expression for the second check (at least one of the following characters: <space> @ # $% ^ &? ;;: _ | {} = + - * () [] ~) :.
<asp:RegularExpressionValidator Display="Dynamic" ControlToValidate="MyPasswordField" ID="MyPassordRequiredCharacterValidator" ValidationExpression="^(?=.*[az])(?=.*[AZ])(?=.*\d)(?=.*[@#$%^&?,;:_|~{}=\+\-\!\.\*\(\)\[\] ]).+$" runat="server" ErrorMessage="Must contain at least one uppercase letter, one lowercase letter, one number, and one special character."></asp:RegularExpressionValidator>
source share