WordPress has an issue where if a long password (500+ characters) is checked for password strength, the browser becomes unresponsive for many seconds or minutes: See issue #31772 for the details.

Possible solutions

1. Use Web Workers to do the strength checking
   • Would this be a welcome contribution?
2. Enhance axcvbn to stop checking strength once a specified threshold of entropy is reached.
   • What would the default threshold be?
3. Only use zxcvbn if the password is more than 32 characters long
   • The problem with this is that weak passwords can be longer than 32 characters. E.g. 33 zeroes: 000000000000000000000000000000000
4. Only use zxcvbn on the first 32 characters
   • Would this make zxcvbn less effective?
5. Improve the performance of the strength-checking for longer passwords
   • Is this even possible without significantly impacting its accuracy?