I know client side security is a joke, but the only reason I made it iterate thousands of times is to increase the time taken to generate a password. That makes brute force attacks unfeasible.