Password requirements (minimum length, character groups that must exist) can be easily validated AND extended using look-aheads.