This answer erroneously passes. It should not pass because something like Pas$w0rd// gets through, but there's no test case to catch that.

Welldone

good work

Wasn't specified in the kata description but that's a good edge case to consider, I suppose.

It doesn't work if n === 0, couse output must be empty string "";

Well, in reality you should be hashing the password, which will destroy a user's ability to inject anything with it, so this whole kata's kind of on iffy ground.

The password isn't url so I think you don't use encodeURI. Do not use a function that has no connection with the subject, try to keep the semantics of the code ;)