Validate a password against a policy

Challenge

Validate a password against a classic policy, reporting every failed rule at once as a bitmask — a structured error report the caller can act on.

Task

Implement int password_check(const char *pw) that returns a bitmask of failed requirements (0 if the password passes all checks).

Input

• pw: a NUL-terminated ASCII password string the grader passes.

Output

Returns int: the OR of the bits for each failed rule:

• bit 0 (1): length < 12
• bit 1 (2): no uppercase letter
• bit 2 (4): no lowercase letter
• bit 3 (8): no digit
• bit 4 (16): no special character (anything that is not alphanumeric and not whitespace)
• bit 5 (32): contains the substring password (case-insensitive)

Example

password_check("Tr0ub4dor&3!")   ->   0    (passes everything)
password_check("short")          ->   27   (1|2|8|16: short, no upper, no digit, no special)
password_check("MyPasswordis123!") & 32  ->   nonzero (contains "password")

Edge cases

• The empty string fails every rule.
• A 12+ char letters-only password still fails the digit and special bits.

Rules

• A space is NOT a special character.
• Implement the case-insensitive password search yourself (strcasestr is non-standard).
• Use >= correctly: length 12 passes the length rule.

Why this matters

Password policies are a balancing act: strong enough to resist common attacks, loose enough to be usable. NIST 800-63B has moved away from forced complexity in favor of length + breached-password checks, but understanding the legacy 'classic' rules is still important for compliance work.

Input format

A NUL-terminated ASCII password string pw.

Output format

An int bitmask: a bit set for each failed rule, 0 if all pass.

Constraints

Space is not special. Length rule is < 12. Single pass over the string preferred.

Starter code

int password_check(const char *pw) { /* TODO */ return 0; }

Common mistakes

Treating space as a special char (it usually shouldn't be); using strcasestr (not standard — implement case-insensitive search yourself); using > instead of >= on the length check.

Edge cases to handle

Empty string fails all. 12+ chars with only letters still fails digit and special.

Complexity

O(strlen).