In my regex expression, I was trying to match a password between 8 and 16 character, with at least 2 of each of the following: lowercase letters, capital letters, and digits.

In my expression I have:

^((?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,16})$

But I don't understand why it wouldn't work like this:

^((?=\d)(?=[a-z])(?=[A-Z])(?=\d)(?=[a-z])(?=[A-Z]){8,16})$

Doesnt ".*" just meant "zero or more of any character"? So why would I need that if I'm just checking for specific conditions?

And why did I need the period before the curly braces defining the limit of the password?

And one more thing, I don't understand what it means to "not consume any of the string" in reference to "?=".