Password validation Regular expression

Question

I have a password validation like the following rules

1. Should contains at most 15 chars and 8 chars at least
2. Password should contain 2 numeral character
3. There is no importance where to put the two numeral chars in start or end even if they anywhere in the password

Answer 1

^(?=\D*\d\D*\d).{8,15}$

Answer 2

The best you can do is present your user with an estimate of the strength of their password and let them shoot their own foot if they wish.

Any scheme to force people to make good passwords is doomed by the ability of people to use post-it notes.