Password Strength Checker | Security Tool by Husain Hakim

Project Overview & Threat Context

PassGuard is a privacy-first, locally-processing web application designed to analyze password security, estimate entropy, simulate cyber attacks, and generate cryptographically secure passwords.

Problem Statement & Objective

Standard regex-based password meters fail to detect predictable patterns like keyboard walks or dictionary words. Furthermore, sending sensitive passwords to a backend server for analysis breaks the threat model entirely. PassGuard solves this by performing rigorous analysis 100% locally.

Security Concepts & Principles

• k-Anonymity Breach Checking
• Shannon Entropy Estimation
• Pattern & Dictionary Detection
• Cryptographically Secure Generation
• Local Processing Architecture

Technologies & Tools

• React
• Vite
• Tailwind CSS v4
• Python
• FastAPI
• Web Crypto API

Technical Architecture & Mechanics

• Local Analysis Engine: All password strength, pattern detection, and entropy calculations happen entirely within the browser.
• k-Anonymity Integration: Securely checks passwords against the Have I Been Pwned database by locally hashing with SHA-1 and only sending a 5-character prefix.
• Pattern Detection Algorithms: Custom logic to flag dictionary words, keyboard walks (qwerty, asdf), sequential characters, and repeated substrings.
• Educational Simulator: Built-in interactive attack simulation visualizing brute-force, dictionary, and pattern-based attacks.

Key Capabilities & Features

• 100% Local Processing ensuring passwords never leave the browser.
• Advanced Entropy Estimation calculating both Shannon entropy and effective bit strength.
• k-Anonymity Breach Checking against known leaked databases.
• Cryptographically Secure Generator using crypto.getRandomValues().

Lessons Learned

• Ensured zero state persistence across reloads requiring careful frontend state management.
• Gained hands-on experience using the Web Crypto API for secure generation and hashing.
• Optimized pattern detection algorithms to run efficiently against long strings on every keystroke using debouncing.
• Implemented a professional security console aesthetic using Tailwind CSS v4 semantic coloring.

Future Roadmap

• Implement multithreaded Web Worker offloading for complex dictionary attack simulations.
• Add support for custom localized wordlists for pattern detection.
• Introduce advanced zxcvbn-style probabilistic guessing models.