[djfobbz]

When I use the following constraints:

    ^.{6,8}$
    [0-9]
    [A-Z]
    [a-z]

I get:

    F񣛯7򴘇󢎺򋛠o
    d1󴆂󯹓󶄁񪥴A񴊆
    𑐟Ku򍅼󨫢9􆯩
    𑍞4񾋚𢗏Rw򂚃񷰗
    I򹪴𦢺򎐝2𵞎򓛹r

I don't think those block chars should be there. Am I missing something?

[ngruhn]

It picks characters from the whole unicode range. Those strings should indeed match all regex constraints. You can add a constraint like:

    ^[\x21-\x7E]*$

To only choose printable ASCII characters.

EDIT: no you're right, there is a bug. I would expect random unicode chars but not always the same box.

[ngruhn]

Actually no again, I think the browser can just not render those.