Regexp for complex password

This might work if there is always a field starting with &, like &txtURL, after the "password=" filed.

I asslumed that since you use a regex that excludes character & , but as you said passwords containing character '&' will not be matched while using this regex you will always have "&" as a character after the password so everything but last & will match.

^.*password=(\K.*)&