here is the ReGex i use for password fields... all the letters and symbols are allowed, and range is from 0 to maximum... * represents= 0 or more than 0 can exists
^[a-zA-Z0-9]*[!,@,#,$,%,^,&,*,?,_,~,-,£,(,)]*$
but this will not allow a letter once a symbol is entered...
so you can modify it to
^[a-zA-Z0-9,!,@,#,$,%,^,&,*,?,_,~,-,£,(,)]*$