The use of ".*" in regex for password validation

Question

I came across this regex used for password validation:

(?=.*[a-z])(?=.*[A-Z])(?=.*[\d])(?=.*[^a-zA-Z\d])(?=\S+$).{8,}

There are only two things that are unclear to me about this regex:

1. what are .* used for and why this regex doesn't work without them?

2. what is the difference/benefit or using [\d] instead of \d, because the regex works just fine in both cases

Answer 1

1. .* matches any sequence of characters; . matches any character (other than newline, which is not relevant here) and * matches zero or more of the preceding pattern. This is used in the lookaheads to search for matches anywhere in the password. If you didn't have it,then it would require that you have those types of characters in a specific order: a lowercase letter followed by an uppercase letter followed by a digit. With .*, it means the password must contain at least one of each of them, but they can be anywhere in the password.

2. There's no difference between \d and [\d]. Whoever write this might just use the brackets out of habit, or perhaps to make it easier to modify it to put other characters into the character class.