Regex:

^(?=[a-zA-Z0-9#@)(?=.*?[a-z])(?=.*?[A-Z])(?=.*?[0-9]).*

Explanation:

In the regex you provided, the lookaheads serves to ensure your string met some specific conditions, but they are not the real filter which keeps out undesired strings. You specified the following conditions:

• (?=.*?[A-Z]): Match at least one uppercase letter.
• (?=.*?[a-z]): Match at least one lowercase letter.
• (?=.*?[0-9]): Match at least one number.
• (?=.*?[#@$?]): Match at least one of these characters: #@$?
• .{8,}: Match any character at least 8 times.

But there are at least two flaws:

• The (?=.*?[#@$?]) part is unnecessary because those special characters are meant to be optional, not mandatory[1].

• As I said before, you did not specify a real filter, so thanks to the .{8,} part, your regex will accept any string as long as it meets the conditions established by the lookaheads, even if it has undesired special characters[1].

So to solve those flaws it is necessary to:

• Delete the (?=.*?[#@$?]) part.

• Add a new lookahead that acts as the filter mentioned above.

To construct this filter, you should think "which characters I want to allow?" instead of "which characters I want to disallow?", because that is a easier scenario to handle in this specific case. If you say you only want a-z, A-Z, 0-9 and #@$? to be your allowed characters, then the lookahead should look like this:

(?=[a-zA-Z0-9#@$?])

But hey, in this step you can even set the minimum length and tell the lookahead where to start and where to stop (the start and end of string in this case):

(?=[a-zA-Z0-9#@)

I omitted the ^ here because it's already at the beggining of everything, so it's not necessary to be redundant. Now we just bring together all the lookaheads and match the valid password using .* instead of .{8,}:

^(?=[a-zA-Z0-9#@)(?=.*?[a-z])(?=.*?[A-Z])(?=.*?[0-9]).*

Note:

1. Although, in the regex and examples you provided, I don't really know why: 1) #@$? were not treated as mandatory; 2) undesired characters were only allowed at the end of the string and not in another place. Maybe it has something to do with the regex engine used by AWS, because everything worked as expected when I tested it on my own.

You need to escape the closing bracket (as well as the backslash) inside your character class. You also don't need all the spaces:

var nospecial=/^[^*|\":<>[\]{}`\\()';@&/;

I got rid of all your spaces; if you want to restrict the space character as well, add one space back in.

EDIT As @fab points out in a comment, it would be more efficient to reverse the sense of the regex:

var specials=/[*|\":<>[\]{}`\\()';@&$]/;

and test for the presence of a special character (rather than the absence of one):

if (specials.test(address)) { /* bad address */ }

The regex "^[^>#*]+$" will match any input apart from something containing >, # or *.

From your existing regex it looks like you don't want to allow : to be the first or last character, in which case the regex you want is this:

"^[^:>#*]+|([^:>#*][^>#*]+[^:>#*])$"

I would just white list the characters.

^[a-zA-Z0-9äöüÄÖÜ]*$

Building a black list is equally simple with regex but you might need to add much more characters - there are a lot of Chinese symbols in unicode ... ;)

^[^<>%$]*$

The expression [^(many characters here)] just matches any character that is not listed.

You just enumerated the special chars without creating a character class defined with the help of [...].

I suggest using a regex literal with a character class matching any of the symbols defined in it:

var blockSpecialRegex = /[~`!@#$%^&()_={}[\]:;,.<>+\/?-]/;

Note that the - should be at the start/end of the character class to denote a literal - symbol. The ] inside must be escaped, but [ does not have to be escaped. / must be escaped because it is a regex delimiter symbol.

JS code:

$('input').on('keypress', function (e) {
var blockSpecialRegex = /[~`!@#$%^&()_={}[\]:;,.<>+\/?-]/;
  var key = String.fromCharCode(!e.charCode ? e.which : e.charCode);
  console.log(key)
  if(blockSpecialRegex.test(key) || $.isNumeric(key)){
    e.preventDefault();
    return false;
  }
  });

<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js"></script>
<input type="text">

Based on what you've given us, this may suit the bill. It will determine if any characters are not in character classes a-z, A-Z or 0-9 but note this will also treat é or similar characters as rejected symbols.

So if the value is 'test_' or 'test a' it will fail but it will pass for 'testa'. If you want it to accept spaces change the regex to /[^a-zA-Z0-9 ]/.

if(!/[^a-zA-Z0-9]/.test($(this).val())) {
    $("#passwordErrorMsg").html("OK");
}