Password strength rules

Four independent lookaheads, each asking "is there one of these anywhere?".

/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^\w\s]).{8,}$/

The problem

Require a password to contain a lowercase letter, an uppercase letter, a digit, a symbol, and at least eight characters.

Follow the line from left to right — every path you can trace is a string this pattern matches.

^(?=.*[a-z])(?=.*[A-Z…In order:
^The start of the text (or of a line with the m flag)
(?=.*[a-z])Ahead of here there must be:
.*[a-z]In order:
.*Any character (except a line break, unless the s flag is set), any number of times, including none, as many as possible
[a-z]Any one of: "a" to "z"
(?=.*[A-Z])Ahead of here there must be:
.*[A-Z]In order:
.*Any character (except a line break, unless the s flag is set), any number of times, including none, as many as possible
[A-Z]Any one of: "A" to "Z"
(?=.*\d)Ahead of here there must be:
.*\dIn order:
.*Any character (except a line break, unless the s flag is set), any number of times, including none, as many as possible
\dA digit
(?=.*[^\w\s])Ahead of here there must be:
.*[^\w\s]In order:
.*Any character (except a line break, unless the s flag is set), any number of times, including none, as many as possible
[^\w\s]Any character except a word character (letter, digit or underscore) or whitespace
.{8,}Any character (except a line break, unless the s flag is set), at least 8 times, as many as possible
$The end of the text (or of a line with the m flag)

Each lookahead is zero-width: it checks from the start and gives the position back, which is why four of them can stack without the pattern needing the characters in any particular order.
The .{8,} at the end is what actually consumes the password — remove it and the pattern matches an empty string.
Composition rules like these are no longer recommended as the primary defence; length and a breach check do more. Encode policy where you can explain it, not only in a regex.