javascript - derive strong password from hash -

i crypto newb, looking avoid blunder. have read quite bit on deterministic password generation. have scheme feel comfortable with. looking on 1 of components.

firstly, plan on using scrypt master password. have other unique inputs combined scrypt output create final password derivative. i'm focused here on question of how adhere different password requirement schemes. below function can run in jsfiddle. should output generated password , number of iterations required match requirements. can store 3 tuple of character requirements password scheme, input parameters, , number of iterations required. hope strong , can avoid bruit forcing. unsure how generate caps, , special characters via typical hex hash conversion, below think works not sure attacks may subject to.

• commenting out padding seems creates issues?
• is there issue converting octal (am losing randomness?) , char?

sample code

var input_secret = "e" var max_it = 1000 var special_chars = 10 var digit_chars = 6 var cap_chars = 4  function hex2a(hexx) {     var hex = hexx.tostring();//force conversion     var str = '';     (var = 0; < hex.length; += 2){       str += //string.fromcharcode(parseint(hex.substr(i, 2), 16));       string.fromcodepoint(parseint(hex.substr(i, 2), 16));     }     return str; }  function sha256(str, it) {   if (it > max_it){     throw new error("can't find match satisfy regex");   }   console.log("iteration: ",it)   // transform string arraybuffer.   var buffer = new textencoder("utf-8").encode(str);   return crypto.subtle.digest("sha-256", buffer).then(function (hash) {     var t = hex(hash)     if (!reg.test(t) && < max_it){         console.log("failed requirements",t)       var new_it = + 1       return sha256(t,new_it)     } else if(it >= max_it){         console.log("horror")         return false           }     else{       return [t,it]     }    }); }  var reg_string = '(?=(.*(\\`|\\~|\\!|\\@|\\#|\\$|\\%|\\^\|\\*|\\(|\\|\\-)){'+special_chars+'})(?=(.*\\d){'+digit_chars+'})(?=.*[a-z])(?=(.*[a-z]){'+cap_chars+'}).{14,14}'  var reg = new regexp(reg_string) console.log("regexp",reg)  function hex(buffer) {   var hexcodes = [];   var view = new dataview(buffer);   (var = 0; < view.bytelength; += 4) {     // using getuint32 reduces number of iterations needed (we process 4 bytes each time)     var value = view.getuint32(i)     // tostring(16) give hex representation of number without padding     var stringvalue = value.tostring(8)      // use concatenation , slice padding     //var padding = '00000000'     var padding = ''     var paddedvalue = (padding + hex2a(stringvalue)).slice(-padding.length)     hexcodes.push(paddedvalue);   }    // join hex strings 1   return hexcodes.join(""); }    console.log("input 'e' should take 454 iterations satisfy 10 special, 6 digits, , 4 caps"); sha256(input_secret,1).then(function(res) {     var digest = res[0]   var iterations = res[1]   var printable_digest = digest.replace(/[^\x20-\x7e]+/g, ''); console.log([[special_chars,digit_chars,cap_chars],printable_digest,iterations]);   console.log("test",reg.test(printable_digest)) });