DEV Community: Jonne Riepponen

I Built a Password Strength Checker That Runs 100% in Your Browser (and What It Taught Me About Passwords)

Jonne Riepponen — Wed, 07 Oct 2026 15:38:39 +0000

The Phone Call That Started This

A client's junior admin called me last month. Their company had just rolled out a new password policy — 14 characters, three character classes, rotation every 90 days — and the helpdesk was drowning in reset tickets. The admin was proud of the policy. The users were writing the new passwords on sticky notes stuck to their monitors.

That is the entire password industry in one story: we keep making the rules harder without making the passwords better.

So I did what I always do when I'm annoyed: I built the thing I wish existed.

The Tool: 100% Client-Side, Nothing Leaves Your Browser

Try the Password Strength Checker — paste a password, get an honest strength rating: length, character classes, and common-pattern weaknesses. No account, no tracking, no server. Open the network tab in dev tools if you don't believe me; nothing is sent anywhere.

Why does that matter? Because a non-trivial number of online "password checkers" submit what you type to their backend for "analysis." Think about that for a second. You are sending your actual password to a stranger's server to find out if it's good. I built mine specifically so that can't happen — there is no backend. The HTML file doesn't even make a fetch request.

What I Actually Learned Testing 200 Passwords

I ran a pile of real-world-style passwords through the checker while building it — the kind of passwords people actually use, not the kind security training pretends they use. Three findings surprised me:

1. Length beats cleverness, every time. A 20-character passphrase of plain words (correct horse battery staple style) outscores an 8-character symbol-soup password on every honest metric. The math isn't close: each extra character multiplies the search space, while swapping e for 3 adds almost nothing because attackers already try that.

2. The complexity rules actively hurt. Forcing symbols and numbers pushes people toward predictable patterns: Password1!, Summer2025!, company-name-plus-year. Attackers' rule lists contain exactly these mutations. A policy that bans those patterns would be ten times more effective than a policy that demands a symbol — but "must contain !" is easier to audit than "must not be predictable," so here we are.

3. Rotation policies create the problem they claim to solve. Every 90-day rotation study I've read says the same thing: users increment a number (...Q3 → ...Q4) or rotate through three passwords. The new password is never stronger; it's just newer. If a password is strong and unique, leave it alone. Rotate on suspicion of compromise, not on a calendar.

What To Do Instead (The Pragmatic Version)

For yourself and your users:

Use a password manager. Bitwarden is free and open source. This is the single highest-leverage security change a normal person can make, and I wrote a 10-minute setup guide for elderly parents that works for anyone.
One long, unique password per service — generated, never reused. Reuse is what actually gets accounts taken over, not weak passwords.
Turn on 2FA everywhere that matters, especially email — email is the master key to every "forgot password" flow you have.
Test your own passwords with the checker. If your scheme produces anything the tool flags as a common pattern, change the scheme, not the password.

The Build Notes (For Fellow Tinkerers)

The whole tool is one self-contained HTML file: vanilla JS, no dependencies, no build step. The scoring is deliberately simple and explainable — entropy estimate from length and character classes, minus penalties for dictionary words, keyboard walks (qwerty, 1qaz), repeated characters, and date/sequence patterns. No machine learning, no API calls, no analytics.

Simplicity is the point. A security tool you can't audit is a security tool you shouldn't trust, and "trust me, it runs locally" is a claim anyone can verify in the network tab.

Try it: Password Strength Checker — free, private, no account. If it saves one person from sending their password to a stranger's server, it was worth the afternoon.

A Sandbox for the Linux Commands You're Afraid to Run

Jonne Riepponen — Mon, 05 Oct 2026 11:55:46 +0000

Almost nobody learns rm -rf the easy way. You read the man page, you use it carefully for a year, and then one day you watch your finger hit Enter a fraction of a second before your brain finishes checking the path.

The commands that destroy data don't punish typos. They punish the half second before the typo, when you were certain the path was right.

That half second of doubt isn't something documentation can give you. So I built a place where you can get it wrong on purpose, with nothing at stake but a score.

A fake shell that keeps score

The whole thing is one HTML file. No build step, no npm, no CDN — 2,340 lines, about 84 KB, and it runs from a local file if you want it to. You can try it here.

The prompt reads sysadmin@danger-zone:~$, and the ~ isn't decoration. Under the surface there's a small state object holding the entire world:

const state = {
    currentDir: '/home/sysadmin',
    dangerLevel: 'LOW',
    commandsUsed: 0,
    safetyScore: 100,
    history: [],
    currentFile: null
};

Seventeen commands are wired up. ls, cd, cat, find, df and ps handle the boring work, so you can navigate a fake filesystem that behaves the way you expect. The other five are the reason the tool exists.

Every dangerous command costs you twenty points

There is no confirmation prompt anywhere in it. That's on purpose. A real shell doesn't stop to ask, so a simulator that stops to ask teaches you the wrong reflex.

You pay in score instead:

if (result.dangerous) {
    triggerDangerEffects();
    state.safetyScore = Math.max(0, state.safetyScore - 20);
    updateStats();
}

Twenty points per mistake, starting from a clean 100. The danger meter recalculates on every keystroke: 80 and above is LOW, 60 is MEDIUM, 40 is HIGH, and anything under that is CRITICAL.

Five mistakes puts you at zero. That number isn't a punishment. It's a count of how many times you would have needed a restore.

The matcher reads tokens, not a real shell

Each dangerous handler inspects the argument array for the exact tokens that make the command lethal:

function rmCommand(args) {
    if (args.includes('-rf') && (args.includes('/') || args.includes('/home') || args.includes('/etc'))) {
        log('Files would be deleted in a real system.', 'error');
        log('In simulation: No actual files were harmed.', 'success');
        return { dangerous: true };
    }
    log('File deletion simulated safely.', 'info');
    return { dangerous: false };
}

dd if=/dev/zero of=/dev/sda triggers an explosion animation. chmod 777 /etc/passwd and iptables -F raise their own security warnings. mkfs /dev/sda1 formats nothing and tells you so.

It's a token check, not a parser. That distinction turns out to matter more than it sounds.

`rm -rf /*` walks straight through

Here's the hole, and I'd rather you hear it from me than find it yourself.

The check asks whether args contains the literal string /. The command that has actually ended careers is rm -rf /*, and after splitting on spaces its arguments are ['-rf', '/*'].

'/*' is not '/'. No match, no warning, no points deducted. The tool congratulates you: File deletion simulated safely.

Same story with rm -rf ~, rm -rf $HOME and rm -rf .. I matched the memorable version of the footgun and missed the common one. If you want to fix that, the honest version is to test each token with a prefix check, not an equality check:

const isRootish = args.some(a => !a.startsWith('-') && /^[/~.]/.test(a));

That's four lines and it catches the cases I shipped without. I'd rather show you the gap than let the tool quietly lie to you about your own reflexes.

Two handlers I wrote and could never reach

The dispatcher splits the line on spaces, then switches on the first token:

const parts = command.split(' ');
const cmd = parts[0];
switch (cmd) {
    case 'cat': catCommand(args[0]); break;
    case 'rm':  result = rmCommand(args); break;

Two cases, though, were written as whole commands with spaces still in them:

case 'cat /dev/random':                 result = randomCommand(); break;
case 'echo 1 > /proc/sys/kernel/panic': result = panicCommand(); break;

cmd is parts[0]. It can never contain a space, so neither case can ever fire. cat /dev/random falls through to the ordinary cat branch and gets quietly ignored.

I found that while going back through the file to write this post. It's the honest argument for writing build logs: the bug had been sitting there since the day I wrote it, and explaining the code out loud is what finally made me look.

What actually protects your data

A sandbox builds the reflex. It does not protect anything. Before you run anything recursive, work through this list:

Dry-run it. rsync -av --dry-run and find . -name '*.log' -print list what would be touched. Read the list properly instead of skimming it.
Print the variable. echo "$TARGET" immediately before you delete "$TARGET". Most rm -rf disasters are a variable that expanded to nothing, or to the wrong path.
Refuse a blank expansion. set -u turns an unset variable into an error instead of a silent empty string, which is the difference between a complaint and a wiped directory.
Check that the mount is mounted. A rm -rf on an unmounted /mnt/backup cheerfully deletes the real directory sitting underneath it.
Prove the backup, don't assume it. Restore one file from last night before you ever need to restore all of them.

The Friday backup audit is a 20-minute version of that last line, and it beats rebuilding a server on a Saturday. When something does go sideways, reading the logs properly is where the fix comes from — not from panic.

The transferable skill is the pause. Practising that pause in a simulator that scores you is cheap. Practising it on your only copy is how the stories start.

What's the command you'd never run without --dry-run? Tell me which one makes you double-check the path.

Related reads: