Hacker News new | ask | show | jobs
by guelo 3645 days ago
If you hash it you can't determine the "strength" of the password except maybe looking up the hash in a rainbow table.
1 comments

Do your strength checks in javascript client-side, then hash, then send. Server side can do further checks if it wants on the hashed password (hey, this password was already used, etc).
any clientside validation can easily be bypassed using something like fiddler.
Password strength checking is (properly understood, in my view) providing help to the user, not enforcing some silly and annoying "password validation" rules.