Password Checker and Hash App

How we built it Frontend: React and TypeScript, with four strength levels mapped to four moods (sad, satisfied, happy, good work). Strength scoring: the zxcvbn engine, which estimates guesses from real patterns instead of character-class rules. Hashing: the browser’s Web Crypto API for SHA-1/256/384/512 and PBKDF2-HMAC-SHA256 with a random 16-byte salt and up to 600,000 iterations. Generator: characters drawn from crypto.getRandomValues with rejection sampling, so there is no modulo bias. Privacy design: no storage and no network calls from the app itself. The breach check follows the k-anonymity model, sending only a 5-character hash prefix and comparing the rest locally. Testing: hash outputs checked against published SHA and RFC PBKDF2 test vectors, and the generator checked for length, character coverage, uniqueness and an even random distribution. Hosting: AWS Amplify. (Edit this to match your real deployment, and add what your Python service does if it is live.) Challenges we ran into Honest strength scoring. Rule-based checkers rate “Password123!” as strong. We switched to pattern-based scoring so it correctly rates that password as weak. Keeping the UI smooth. PBKDF2 at 600,000 iterations is deliberately slow, so we made hashing asynchronous and debounced it to stop typing from freezing. Proving privacy. We had to design every feature so the password never leaves the browser, including the breach check. Fair randomness. A naive random picker is slightly biased, so we used rejection sampling and tested the distribution.

Accomplishments that we’re proud of A password tool that never sees your password on a server. Strength results that explain themselves: attack scenarios, patterns found and concrete fixes. Hash and PBKDF2 output verified against published test vectors. A breach-check explainer that makes k-anonymity easy to understand. A clear, friendly interface with a mood for each strength level. What we learned Hashing is not encryption: a hash cannot be reversed, but it can be guessed. Fast hashes like plain SHA-256 are a poor way to store passwords. Salts and slow key derivation are what make stolen databases hard to crack. Complexity rules matter less than length and unpredictability. A breach check can be private by design, because the service only needs 5 characters of a hash. Doing everything client-side removes most of the trust users have to place in a security tool. What’s next for Password Checker and Hash App Switch on the live Have I Been Pwned range lookup in the full app. Add Argon2id and bcrypt demos through WebAssembly, so the hash comparison covers the modern standard. Add an optional AI coach that receives only the strength analysis, never the password, and suggests memorable passphrase patterns. Play your four mood videos from Cloudinary for each strength level. Release a browser extension that checks passwords as people sign up. Add a guide to passkeys and password managers, with local-language common-password lists.

Built With

• python
• react-and-typescript