According to OWASP, which uses references from Microsoft AD, and Oracle Identity Manager, these symbols are allowed.

!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

https://www.owasp.org/index.php/Password_special_characters

However, I suppose that only answers your "usually" question. OWASP further explains that "Various operating systems and applications may apply limitations to this set".

Which to me says, it's completely subjective. Meaning, if I'm an application developer, I can choose to utilize industry standards (OWASP), or use my own subset.

So, to answer the "always" question, I think it would be safe to assume that these are acceptable.

!#$%&()+-/:;@[\]^_|~

Additionally, given the above information, I would go with these as the "sometimes forbidden" options.

"$%'()*+,-./:;<=>[]`{}

Since this is somewhat of a subjective question, no answer given can be 100% accurate. I think this should help with your task though..

Use regex pattern ^(?=.{8})(?=.*[^a-zA-Z])

Explanation:

^(?=.{8})(?=.*[^a-zA-Z])
│└──┬───┘└──────┬──────┘
│   │           │
│   │           └ string contains some non-letter character
│   │
│   └ string contains at least 8 characters
│
└ begining of line/string

If you want to limit also maximum length (let's say 16), then use regex pattern:

^(?=.{8,16}$)(?=.*[^a-zA-Z])