Minimum length 7
This part is unsurprisingly the simplest. You can just use:
.{7,}
In order to perform the other checks in a single regex, you need to make use of look-aheads as follows:
at least one upper-case
(?=.*[A-Z])
at least one number
(?=.*\d)
without special characters
I would strongly advise against this requirement if at all possible. Adding this does not improve your security, and will only frustrate your users. But, if you really must, then:
(?!.*[^a-zA-Z0-9])
(Modify the above as appropriate -- depending on what exactly you mean by "special" characters.)
Putting this all together into a single pattern, the final answer is:
\A(?=.*[A-Z])(?=.*\d)(?!.*[^a-zA-Z0-9]).{7,}
You could also simplify this regex slightly, by merging the "no special chars" and "minimum length" requirements into a single regex condition as follows:
\A(?=.*[A-Z])(?=.*\d)[a-zA-Z0-9]{7,}\z
(Note the additional use of a \z
anchor here, in order to check that all password characters are in the whitelisted "non-special" characters.