The asker's original inclination to use str.charCodeAt(i) appears to be faster than the regular expression alternative. In my test on jsPerf the RegExp option performs 66% slower in Chrome 36 (and slightly slower in Firefox 31).

Here's a cleaned-up version of the original validation code that receives a string and returns true or false:

function isAlphaNumeric(str) {
  var code, i, len;

  for (i = 0, len = str.length; i < len; i++) {
    code = str.charCodeAt(i);
    if (!(code > 47 && code < 58) && // numeric (0-9)
        !(code > 64 && code < 91) && // upper alpha (A-Z)
        !(code > 96 && code < 123)) { // lower alpha (a-z)
      return false;
    }
  }
  return true;
};

Of course, there may be other considerations, such as readability. A one-line regular expression is definitely prettier to look at. But if you're strictly concerned with speed, you may want to consider this alternative.

You want to add "one or more", you're currently checking for a letter followed by a number.

Try:

/^[a-zA-Z0-9]+$/

+ means 'one or more'

I also joined the ranges.

Note: I don't understand why you'd want to limit the password to such a small range though, having a wide character range will make your passwords stronger.

Here is a fiddle demonstrating the correct behavior

If you just want to validate that the password has at least one letter and at least one number, you can check like this:

function checkPasswordComplexity(pwd) {
    var letter = /[a-zA-Z]/; 
    var number = /[0-9]/;
    var valid = number.test(pwd) && letter.test(pwd); //match a letter _and_ a number
    return valid;
}