[anymouse123456]

Just came here to say, please don't do this to your users, or your business.

Also, can someone please tell me that Facebook doesn't really do this?

[jerbear4328]

Facebook does do this, and it's perfectly fine: https://security.stackexchange.com/a/214815

It exchanges a few bits of entropy for a much smoother user experience, and it doesn't actually aid an attacker much (they could just try the permutations themselves)

[anymouse123456]

Thanks for the link. That's helpful info.