As your characters are received, place them into a character string array.
When you detect a terminator character, check your assembled array against a password array.
Maybe add a timeout function where if the characters do not arrive within a certain period, cancel the attempt and flash an error LED.