Use a non echoing getchar() method. And for each character grab, send * to stdout. It depends on your platform though, on Linux I use curses/ncurses for achieving this (noecho() function).
And same goes for your \n. Windows does the 2 things - Carriage Return and Line Feed (CRLF), while on Linux it'd just be a single Line Feed (LF), and on Macintosh it is just a Carriage Return (CR). Windows is the only one doing both characters.
I guess you can intercept that behavior since you know it happens that way?
P.s. What language? Some have inbuilt password masking functions.
P.p.s. I just realized that \n is just for newline, and not for carriage return too, which is \r. So I don't know how its occupying 2 bytes if its not specified to, maybe its Windows indeed at work? Perhaps use \n\r together to avoid this confusion.