Try:
if regexp_instr(password,regular_expr)
Instead of:
if regexp_instr('password',regular_expr)

Also, take into consideration regexp_instr doesn't count how many "password" characters are in "regular_exp" but returns the position of the first "password" character that matches any "regular_expr" character so, for a password like AmyPaSsWord it would return "1"