This needs a proper save system.Using passwords in a ROM hack of a game from 1996 in 2017 instead of SRAM seems a little old, don't ya think?
Well, the password has to store the following as a minimum:
Score (stored in one unsigned word) - 16bits
Level reached - 5 bits
Time challenge reached - 5 bits
Chaos emeralds unlocked, assuming one per zone - 7 bits
Medals found - 14 bits
Total - 47 bits
32 different characters for each "letter" of the password gives you 5 bits per letter
So you'd need a 10 character long password to cover the 47 bits, plus an extra character as a checksum.
So currently the password is likely to be 11 to 12 characters long. And that's without storing lives or anything...