Password strength check (local)

Challenge

Score a password's strength with a simple heuristic — a real system would also check it against breached-password lists.

Task

Implement int score_password(const char *p) that returns a 0-4 integer score.

Input

• p: a NUL-terminated password string the grader passes.

Output

Returns int: one point each (capped at 4) for length >= 8, containing an uppercase letter, containing a digit, and containing a non-alphanumeric character.

Example

score_password("")           ->   0
score_password("Ab1!")       ->   3   (upper, digit, special; too short)
score_password("Tr0ub4dor!") ->   4
score_password("thisislong") ->   1   (length only)

Edge cases

• The empty string scores 0.
• A long all-lowercase password scores only 1 (length).

Rules

• Walk the string once, tracking the four conditions, then sum them.

Why this matters

Checking password strength is a perennial real-world feature: signup forms, admin dashboards, security audits. Writing the rule engine clarifies how (and why) modern NIST guidance prefers length over complexity.

Input format

A NUL-terminated password string p.

Output format

An int score 0-4: one point each for length>=8, an uppercase letter, a digit, a special char.

Constraints

Cap the score at 4. Single pass over the string.

Starter code

#include <ctype.h>
#include <string.h>

int score_password(const char *p) {
    /* TODO */
    return 0;
}

Common mistakes

Counting categories without considering length (a 12-char all-lower password is still trivial to brute-force). Using regex for what character-class checks do simply. Allowing the literal word 'password'.

Edge cases to handle

Empty string — score 0. Very long (32+) string with only letters — still weak by some scoring rules.

Complexity

O(strlen).

Background lessons

• Input validation
• C strings

Up next

• Validate a password against a policy
• Constant-time byte compare