Just a comment, instead of comparing the raw bufs, why not compare the strings directly?

Just a comment, instead of comparing the raw bufs, why not compare the strings directly?

I tried to follow the existing code's usage of raw bufs over strings. Presumably it's a security thing related to Why is char[] preferred over String for passwords? although OP would have to confirm their intent.

Just a comment, instead of comparing the raw bufs, why not compare the strings directly?

I tried to follow the existing code's usage of raw bufs over strings. Presumably it's a security thing related to Why is char[] preferred over String for passwords? although OP would have to confirm their intent.

Crypto APIs work with byte arrays (Uint8Array), for obvious reasons (if not obvious let me know, I can explain why).

You could compare the two values as string, before turning them into byte arrays. That should be good enough.
(is there really no built-in to compare two arrays by value in JS...?)

Also, this PR is one commit that does 2 things:

• Add a second "confirmation" password box
• Change the password type field to 'password'

If you could split that into 2 commits, that increases the chances I'll review and merge this PR (no promises).