I'd love to run some math on the entropy this actually gives you... If you assume people are using common dictionary word passwords, you could even develop spec

I'd love to run some math on the entropy this actually gives you... If you assume people are using common dictionary word passwords, you could even develop special tables based on common letter positions or substrings. Assuming a character is 5 bits of entropy... An 8 character password gives you 8 choose 4 = 70 possible variations it could ask. Each variation is 4 characters (20 bits of entropy). So, that brings it up to 20+log2(70)=26.1 bits of entropy for an 8 character password... Compared to 40 bits of entropy normally... And that's not even accounting for using common words/phrases. This scheme seems to lose about 1/3 the entropy. 12 character password gives only... 28.9 bits of entropy instead of the expected 60 bits. And that's not even including more obvious attacks like stealing the plaintext from the server, since it obviously isn't salted on the server side (and it reveals the length of your password on the front end too??) Edit: I noticed I used "choose 4" instead of "choose 5" but the math is similarly bad. I leave it as an exercise for the reader.