@bootlesshacker The regex checks that the password contains one of the permitted chars, but it doesn't check that it does not include the chars that they've not permitted. So, as long as you include a permitted special char, you can include any other non-alphanumeral too.