I'm wondering whether the validator is acting on the text you type or the "***" it is getting replaced with. If you go back to your original regex and turn off the password flag, does it work then?