There is no need to use the (possibly dangerous) String class (capital S). And why do you try to convert it?
String code = "12345";
char keys[5];
.....
String str(keys);
The question is what ..... is; you were told not to post snippets 
And I'm not going to dig for other threads As it stands now, keys is not initialised and next you try to make a string of an uninitialised variable; recipe for disaster.
When you press the # key, add the null terminator to that character array. Next you can use the C-string functions like strlen() and strcmp() and ...
For the code in reply #4, if the character array is null terminated
if (strcmp(keys, "12345") == 0)
{
// match
}
For the code in the opening post, if the character array is null terminated
for(unsigned int a = 0; a < strlen(keys); a = a+1)
{
Serial.print(keys[a]);
}
Or indeed a simple Serial.println(keys).