Oh, I agree. Every keystroke seems like overkill. If I were in charge of both requirements and implementation I'd debounce the input by 300-500ms and display a

Oh, I agree. Every keystroke seems like overkill. If I were in charge of both requirements and implementation I'd debounce the input by 300-500ms and display a "loading" spinner in the password complexity box until the debounce timer and network request had fully resolved. I was just trying to explain why, given some business use-cases, doing password validation on the client isn't always possible.