If you look at the MSDN link , it gives an example of a RegEx expression for password verification and (more precisely) use it in ASP.NET.
For what you want to accomplish, this should work:
(?!^[0-9]*$)(?!^[a-zA-Z]*$)^([a-zA-Z0-9]{8,20})$
This requires at least one digit, at least one alphabetic character, no special characters and a length of 8 to 20 characters.
source share