"Password must contain 1 uppercase letter, 1 lowercase letter, and 1 number." With a rule like that, the password Abcd1234 would pass your validation, but mu-icac-of-jaz-doad would not.

http://ryanwinchester.ca/post/stop-forcing-your-arbitrary-password-rules-on-me

Ryan makes an excellent suggestion to replace password rules by an entropy estimator like Zxcvbn.