string.indexOf() always returns a non-zero value
The problem here is that indexOf returns the position of the character in the string, or -1 if it's not found.

In C 0 is false and everything else is true. That includes -1. 

However, your usage if String here to just check for one character is incredibly wasteful and should be avoided. Instead, use strchr:

if (strchr(new_password, '#') != NULL) {
    ... contains # ...
}