I know this is not exactly the answer you're looking for, but I always look at whether I can put such validations into a CustomValidator with a server-side method OnValidate.
Regexes are fun, and great for puzzlers but there are always people who don't get them and won't understand what you are doing.
Always try to err on the side of readability and ease of understanding, particularly if you foresee that you won't be the one maintaining the solution.
While this may seem overly verbose I find this is the kind of solution with the least grief in the long run.
I would use a CustomValidator like this in the ASP page:
<asp:CustomValidator ID="rev1" runat="server"
ValidateEmptyText="true"
ControlToValidate="TextBox1"
SetFocusOnError="True"
Display="Dynamic"
OnServerValidate="validatePasswordField"
ErrorMessage="Password must be 6 characters long"/>
And in the code-behind I'd put something like this:
private const int EMPTY_PASSWORD_LENGTH = 0;
private const int MIN_PASSWORD_LENGTH = 6;
private const int MAX_PASSWORD_LENGTH = 6;
protected void validatePasswordField(object source,
ServerValidateEventArgs args) {
if (source == null) return;
string candidatePassword = TextBox1.Text;
args.IsValid = isValidPasswordText(candidatePassword);
}
private bool isValidPasswordText(string candidate) {
return candidate.Length == EMPTY_PASSWORD_LENGTH
|| (candidate.Length >= MIN_PASSWORD_LENGTH
&& candidate.Length <= MAX_PASSWORD_LENGTH);
}
Well, actually I'd pull the isValidPasswordText(string) definition out into a business-layer class, but that's more of an architectural decision.