What's wrong with strlen(password)+1?