I have read this several times and still don't understand the point of what you want to achieve. Some loud alarm bells ring - it looks like you're making a brand new hash algorithm. Don't every do that. Use one of the existing ones. For one, in the one you outlines, anagrams give the same hash value.

If you want everything to be client-side then you're out of luck. The client controls everything, and tweaks of the Javascript, to invert the logic of the password check, will break everything. You could have the password be the decryption key for the rest of the code to run, but I don't understand the goal.

What's the threat model? Who's is going to try to do what?