Hash passwords with bcrypt and verify hashes — all client-side, cost-factor adjustable.
Memorable, strong passphrases — generated in your browser