3 ms·

I agree that that will be safe, provided you use the same browser-side hash function that the bank uses