You can, but why? I assume you're vetting potential passwords. Password policies have a way of changing (usually to add new restrictions). Your code will be more maintainable if you have one regex per restriction. Then, when the higher-ups add "passwords can't contain repeated patterns", changing the code will be easier.