check if string contains both number and letter (at least)

([0-9].*[a-zA-Z])\|([a-zA-Z].*[0-9])

Not sure if the pipe needs to be escaped in your regexp environment or not.

You can use lookahead assertions to check for existence of any digit and any letter as:

^(?=.*[a-zA-Z])(?=.*[0-9])

Using a single regex for this can lead to somewhat unreadable/unreliable code. It may make more sense to use simpler regexes eg [0-9] to check for the existence of a digit and break the requirements of your password strength checker into a multi-line if. Also this allows you to know more readily at what stage the validation failed and possibly make suggestions to the user.