About the service
I create password strength check widgets that are embedded directly in registration forms and show visitors an honest assessment of password strength as they type. The indicator recalculates on every keystroke: I calculate entropy, look for repeating and predictable sequences, keyboard layouts and letter-to-digit substitutions — so the scale grows not just from string length, but from real combination strength.
Next to the indicator I show short tips — add a character, remove repetition, don't use login or birth date as part of password — that guide users toward a genuinely more secure password. Tips never show or log already entered characters: this is important both for privacy on shared screens and for correct operation with screen readers.
Weak passwords and those already exposed in breaches are blocked before form submission. The check uses a hash request via the k-anonymity algorithm: only part of the hash is sent over the network, the password itself is never transmitted or stored in plain text. I embed the widget into existing markup and validation logic, keep the script light so it doesn't slow the page, and ensure the form remains functional with JavaScript disabled.
What's included in the work:
— password strength indicator with entropy-based assessment
— contextual tips without revealing entered text
— breach database check via k-anonymity
— keyboard accessibility and screen reader support
— styling to match existing form design
Next to the indicator I show short tips — add a character, remove repetition, don't use login or birth date as part of password — that guide users toward a genuinely more secure password. Tips never show or log already entered characters: this is important both for privacy on shared screens and for correct operation with screen readers.
Weak passwords and those already exposed in breaches are blocked before form submission. The check uses a hash request via the k-anonymity algorithm: only part of the hash is sent over the network, the password itself is never transmitted or stored in plain text. I embed the widget into existing markup and validation logic, keep the script light so it doesn't slow the page, and ensure the form remains functional with JavaScript disabled.
What's included in the work:
— password strength indicator with entropy-based assessment
— contextual tips without revealing entered text
— breach database check via k-anonymity
— keyboard accessibility and screen reader support
— styling to match existing form design
