Infernified
Privacy-first client-side password security analyzer with k-anonymity breach detection.
Solo Developer
Cybersecurity & Web Cryptography
2026
Project Overview
Infernified is an educational password vulnerability analyzer built around zero-trust client privacy. Rather than transmitting raw passwords or full hashes to third-party verification servers, all analysis is performed locally in the browser, with external breach checking restricted strictly to mathematical 5-character SHA-1 prefix ranges.
Engineered using native Web Crypto API (SubtleCrypto) to generate SHA-1 digests locally. The first 5 hexadecimal characters are transmitted to the Have I Been Pwned Pwned Passwords range API, which returns hundreds of matching hash suffixes that are then compared locally against the remainder of the client hash.
Adopted k-anonymity range lookups to make it mathematically impossible for any intermediate observer or the HIBP API itself to reconstruct the analyzed password. Relies exclusively on crypto.getRandomValues() for cryptographically unguessable password generation rather than pseudo-random generators.
Key Capabilities & Features
K-Anonymity Breach Verification
Transmits only a 5-character hash prefix to HIBP, downloading hash suffix candidates and performing the match calculation entirely inside the browser.
Deterministic Entropy & Pattern Scorer
Computes pool-based Shannon entropy approximations and evaluates sequential digits, keyboard paths, and repeated substring patterns.
Cryptographic Password Generator
Generates custom entropy-balanced character sequences using the browser's native crypto.getRandomValues() system API.