> That 250MB password will be run through scrypt by javascript

No, it will not. Nobody does this.