Using regex to validate passwords

I was trying to validate the strength of passwords in this way using regex at least: one number, one special character, at one Capital Letter, and 8 characters long. I thought these would do: re.compile(r'[a-zA-Z0-9+-!._]{8,}') re.compile(r'(_\.\+\-!\?)+[a-z]+[A-Z]+[0-9]+') However, both aren't working: the first one doesn't calculate the 'at least' rule, while the second only matches in a specific order, which is useless. How can we do that? Your answer would clarify much about practical use of regular expressions.